China-aligned Bronze Sandcastle uses Sandboxie DLL sideloading to deploy backdoors against targets in Asia and Africa
Sophos has disclosed Bronze Sandcastle, a previously undocumented China-aligned threat cluster active since mid-2025. Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. Its most distinctive marker is consistent DLL sideloading of legitimate Sandboxie executab…