Ethical Hacking News
China-Aligned Bronze Sandcastle Malware: A Sophisticated Threat Cluster Targeting Organizations Worldwide
A new threat cluster, dubbed Bronze Sandcastle, has been identified as a sophisticated and well-coordinated campaign aimed at deploying backdoors and leveraging DLL sideloading techniques to gain unauthorized access to systems. This threat cluster has been observed targeting organizations in Asia and Africa since mid-2025, and is believed to be a China-aligned threat cluster. The malware uses legitimate Sandboxie executables and a malicious "sbiedll.dll" file to gain access to systems, and communicates with external sites to receive additional tasking from its operators. Cybersecurity experts are urging organizations to focus on behavioral indicators and to stay vigilant in light of this new threat cluster.
The China-Aligned Bronze Sandcastle malware cluster is a sophisticated threat targeting organizations in Asia and Africa. DLL sideloading is a technique used by the threat cluster to gain unauthorized access to systems by tricking legitimate programs into loading malicious DLLs. The Bronze Sandcastle malware uses legitimate Sandboxie executables and a malicious "sbiedll.dll" file to deploy backdoors and stage attacks. The malware communicates with external sites for command-and-control and uses different versions with distinct communication methods. Organizations should focus on behavioral indicators such as DLLs reading local files followed by immediate in-memory execution.
The recent revelations about the China-Aligned Bronze Sandcastle malware cluster have sent shockwaves throughout the cybersecurity community. This threat cluster, which has been observed targeting organizations in Asia and Africa since mid-2025, has been identified as a sophisticated and well-coordinated campaign aimed at deploying backdoors and leveraging DLL sideloading techniques to gain unauthorized access to systems.
At the heart of this threat cluster is a technique known as DLL sideloading, which exploits the way Windows loads DLL files to allow an attacker to trick a legitimate program into loading a malicious DLL. This technique, popularized by adversaries in recent years, takes advantage of the way operating systems look for DLLs in a predetermined sequence of directories. By planting a malicious DLL with the same name as a legitimate one in a location that Windows searches before the folder that contains the actual DLL, an attacker can trick a legitimate application into loading and running the malicious DLL, thereby gaining access to the system.
The Bronze Sandcastle threat cluster has been observed to use legitimate Sandboxie executables placed in multiple victim environments, along with a malicious "sbiedll.dll" file, which causes the trusted application ("SandboxieWUAU.exe") to load attacker-controlled code during runtime. This design minimizes static detection and allows operators to adjust behavior without replacing DLL binaries. Renamed legitimate executables are frequently used to blend into victims' environments, with execution resulting in in-memory shellcode activity rather than additional disk artifacts.
Furthermore, the payload of the Bronze Sandcastle malware has been found to communicate with external sites, likely in an attempt to receive additional tasking from its operators. Two different versions of the payload have been identified to date: 1.1.5 and 1.1.7. The payload has also been observed using dc.cathaypacifice[.]com and net.dpworldto[.]com for command-and-control (C2). Version 1.1.7 payloads, on the other hand, have been observed communicating with GitHub repositories ("github[.]com/LatonyCharnleyaW") via the API to download encrypted config files.
The Bronze Sandcastle threat cluster is not the first time Chinese hacking groups have relied on DLL sideloading, nor is it the first time Sandboxie has been employed in such attacks. In July 2024, the APT41 threat actor leveraged a different executable signed by Sandboxie ("taskhost.exe") to sideload a malicious version of "sbiedll.dll" to deploy a backdoor called MoonWalk ultimately.
In light of this new threat cluster, cybersecurity experts are urging organizations to focus on behavioral indicators such as DLLs reading local files followed by immediate in-memory execution, which may indicate decoding and staging activity. Sophos security researcher Gabor Szappanos noted that "Because the malicious code is executed by a trusted and often digitally signed application, it is less likely to be flagged by antivirus software and other security solutions." If the legitimate application runs with elevated privileges, the malicious DLL will inherit those same permissions, allowing the attacker to perform more sensitive actions on the system.
The Bronze Sandcastle threat cluster highlights the ongoing threat posed by nation-state actors and their reliance on sophisticated malware techniques to gain unauthorized access to systems. As cybersecurity professionals, it is essential to stay vigilant and keep abreast of the latest threats and techniques employed by adversaries.
Related Information:
https://www.ethicalhackingnews.com/articles/China-Aligned-Bronze-Sandcastle-Malware-A-Sophisticated-Threat-Cluster-Targeting-Organizations-Worldwide-ehn.shtml
https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html
https://cybersecuritynews.com/china-linked-hackers/
https://utopiats.com/blog/china-aligned-bronze-sandcastle-abuses-sandboxie-dll-sideloading-to-deploy-backdoors
Published: Wed Oct 21 13:07:14 2026 by llama3.2 3B Q4_K_M
