BRONZE SANDCASTLE abuses Sandboxie and other apps via DLL sideloading

Sophos researchers reported that the China-linked threat group BRONZE SANDCASTLE exploits DLL sideloading in trusted Windows applications to install backdoors. The attackers place malicious files alongside legitimate software, allowing familiar programs to execute attacker-controlled code without modifying the original application. This method enables the group to collect system details and steal Active Directory credential data.

Root cause

The vulnerability stems from how certain Windows applications load dynamic link libraries from the same directory as the executable. By placing a malicious library with the expected name next to a trusted program, the application loads the harmful code instead of the intended one. This technique allows attackers to run hidden backdoors while the visible application remains unchanged, blending malicious activity into normal system operations.

Attack path

Attackers deploy legitimate programs like Sandboxie, Java, Krita, NVDA, LINE, and Microsoft Sysinternals tools alongside malicious supporting libraries. When the trusted application launches, it loads the attacker-provided library, handing execution control to the group. The malicious library reads an encrypted payload from a local configuration file, decodes it, and executes the code in memory. This separation allows operators to change payload behavior without replacing the loading library.

Affected versions

The source material does not specify exact software versions affected. It notes that the campaign abused components from Sandboxie, Java, Krita, NVDA, LINE, and Microsoft Sysinternals. Researchers observed these attacks between August 2025 and August 2026. The technique relies on the loading behavior of these specific trusted applications rather than a version-specific flaw in a single product.

Mitigation

• Monitor for unexpected library loading in trusted application directories.
• Restrict execution permissions in directories containing sensitive applications.
• Verify the integrity of supporting files for critical software.
• Check for renamed executables that do not match known application patterns.

Detection notes

Teams usually notice this activity by monitoring for legitimate applications loading unexpected or newly created libraries. Security operations should check whether trusted programs are accessing encrypted configuration files they do not normally require. Analysts should look for memory injection techniques where code is decoded and executed without writing to disk. Containment moves typically involve isolating affected endpoints to prevent credential theft and blocking further communication with command and control servers.

What to do and how to stay safe: BRONZE SANDCASTLE

• Review endpoint logs for trusted applications loading unfamiliar dynamic link libraries.
• Scan systems for renamed executables that mimic legitimate software names.
• Check for encrypted payloads being decoded in memory by standard applications.
• Once the vendor provides an update, apply patches to any affected software immediately.

Step-by-step guide: Phishing Defenses: Answers to 10 Critical Questions

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which threat group is responsible for this campaign?

The group is tracked as BRONZE SANDCASTLE by Sophos researchers.

What regions were targeted in this campaign?

Victims were found in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea.

Does this malware use standard Metasploit shellcode?

No, Sophos found custom function-resolution routines and a larger codebase than standard examples.