Bronze Sandcastle Uses Sandboxie to Sideload Backdoors
Sophos has detailed a previously undocumented China-aligned threat cluster, Bronze Sandcastle, which has targeted organizations in Asia and Africa since mid-2025. Activity observed between August 2025 and August 2026 affected victims in the Philippines, Taiwan, Afghanistan and Namibia, with likely victims in South Korea. Sophos assessed that the operator is most active in the UTC+8 time zone.
The group’s defining technical pattern is DLL sideloading through Sandboxie. Investigators found legitimate Sandboxie executables deployed in victim environments alongside a malicious file named sbiedll.dll. When the trusted SandboxieWUAU.exe executable runs, it loads the attacker-controlled DLL and executes its code.
Trusted applications used as a loading path
DLL sideloading abuses Windows DLL search behaviour. When an application does not specify the complete path to a required library, Windows searches directories in a defined order. An attacker can place a malicious DLL carrying the name of an expected library in a location searched before the genuine file, causing the legitimate application to load the malicious code.
This approach can make detection more difficult because the code runs through a trusted, often digitally signed program. It can also inherit the permissions of that program. If the affected application starts automatically after a reboot, the same mechanism can provide a persistence path.
Sandboxie is not Bronze Sandcastle’s only loading vehicle. Sophos documented seven further executable-and-DLL combinations: javaw.exe with jli.dll, Krita.exe with Krita.dll, NvdaHelper.exe with NvdaHelperRemote.dll, Jcef_helper.exe with Libcef.dll, Vmmap.exe with version.dll, LineAppMgr.exe with msvcp140.dll, and bginfo64.exe with snmpapi.dll. Renamed legitimate executables were also used to blend into victim environments.
Encrypted payloads and backdoor functions
The sideloaded DLLs typically read encrypted payloads from files named config.ini and execute them. Sophos said this design reduces static detection opportunities and lets operators alter behaviour without replacing the DLL binary. Execution leads to in-memory shellcode activity rather than additional artifacts written to disk.
Two payload versions, 1.1.5 and 1.1.7, have been identified. The backdoor can enumerate local network and user accounts, collect system metadata and running-process information, and capture keystrokes and screenshots. It was also observed communicating with file[.]io, gofile[.]io, ably[.]net and ably[.]io, likely to obtain further tasking.
Version 1.1.5 used dc.cathaypacifice[.]com and net.dpworldto[.]com for command-and-control. Version 1.1.7 communicated through the GitHub API with the repository github[.]com/LatonyCharnleyaW to download encrypted configuration files; the account is no longer accessible.
Detection focus for defenders
DLL sideloading and Sandboxie have both appeared in China-linked operations before. In July 2024, APT41 used a different Sandboxie-signed executable, taskhost.exe, to sideload a malicious sbiedll.dll and deploy the MoonWalk backdoor.
Sophos recommends concentrating on behavioural evidence because encrypted payload and configuration files are decoded at runtime. For businesses, a practical priority is to investigate sequences in which DLLs read local files and are followed immediately by in-memory execution, while also reviewing unexpected Sandboxie binaries and DLLs in endpoint environments.