BRONZE SANDCASTLE: suspected China-based cluster uses Sandboxie DLL sideloading and custom backdoors to steal ntds.dit in Asia and Africa

Linha do tempo

1. thehackernews.com ↗ · pub. 21/10/2026 09:05 · coletado 21/10 10:00

   China-aligned Bronze Sandcastle uses Sandboxie DLL sideloading to deploy backdoors against targets in Asia and Africa

   ler a análise desta fonte ocultar

   Sophos has disclosed Bronze Sandcastle, a previously undocumented China-aligned threat cluster active since mid-2025. Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. Its most distinctive marker is consistent DLL sideloading of legitimate Sandboxie executables. The sideloaded DLLs decrypt and run an encrypted backdoor payload, and activity patterns suggest operators in the UTC+8 time zone. The article notes that APT41 abused Sandboxie's sbiedll.dll in a similar way in July 2024 to deploy MoonWalk, but it does not link the two groups.

   Technical Details

   • A legitimate Sandboxie executable (SandboxieWUAU.exe) is dropped alongside a malicious sbiedll.dll, which loads attacker-controlled code at runtime.
   • Seven other sideloading pairs were observed: javaw.exe with jli.dll; Krita.exe with Krita.dll; NvdaHelper.exe with NvdaHelperRemote.dll; Jcef_helper.exe with Libcef.dll; Vmmap.exe with version.dll; LineAppMgr.exe with msvcp140.dll; bginfo64.exe with snmpapi.dll.
   • The DLLs read and execute payloads from encrypted config.ini files, which lets operators change behavior without replacing the DLLs. Renamed legitimate executables are common, and execution produces in-memory shellcode activity rather than extra disk artifacts.
   • The backdoor enumerates the local network and user accounts, and collects system metadata, running processes, keystrokes and screenshots. Payload versions 1.1.5 and 1.1.7 have been identified.
   • Payloads contact file[.]io, gofile[.]io, ably[.]net and ably[.]io, likely to receive tasking. Version 1.1.5 uses C2 domains dc.cathaypacifice[.]com and net.dpworldto[.]com. Version 1.1.7 pulls encrypted config files via the API from the GitHub repository github[.]com/LatonyCharnleyaW, an account that is no longer accessible.

   Remediation

   • Static file-based detections may be ineffective because payloads and configs are decoded at runtime.
   • Sophos recommends focusing on behavioral indicators, such as DLLs reading local files followed by immediate in-memory execution, which may indicate decoding and staging.
   • Hunt for the listed legitimate-executable and DLL pairings running from unexpected locations, and for the listed domains and the GitHub repository.
2. gbhackers.com ↗ · pub. 21/10/2026 08:41 · coletado 21/10 09:00 primeiro registro

   BRONZE SANDCASTLE (suspected China-based) uses Sandboxie DLL sideloading and custom backdoors to steal Active Directory ntds.dit

   ler a análise desta fonte ocultar

   BRONZE SANDCASTLE is a suspected China-based intrusion set. Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. Its operators sideload malicious DLLs into legitimate applications, then run encrypted payloads in memory. After deployment they enumerate accounts and steal the Active Directory database (ntds.dit) through Volume Shadow Copies. SophosLabs researchers gave the activity a separate designation because the tooling could not be reliably tied to established groups. Activity clustered in UTC+8 working hours, which supports the China-based assessment. Geographic overlap with BRONZE PRESIDENT and BRONZE ATLAS is not enough to show shared operators.

   Technical Details

   • The signature technique is abuse of Sandboxie executables (e.g. SandboxieWUAU.exe, a renamed Start.exe) to load an attacker-controlled sbiedll.dll (T1574.001). Other abused programs include Java (javaw.exe with a malicious jli.dll), Krita, NVDA, LINE and Sysinternals utilities.
   • A recovered archive, aez.zip, held javaw.exe, malicious jli.dll and an encrypted config.ini. The DLL reads and decodes the config, then transfers execution into memory. Keeping the payload separate from the loader lets operators change functionality without replacing the DLL.
   • The loader uses flattened control flow built on a virtualized state machine, with byte swapping, rotations, inversion and negation feeding indirect jump tables. It resembles stageless Metasploit payloads but uses custom API hashing.
   • The decoded payload is a position-independent reflective loader that loads an embedded executable in memory. It contains elements tied to TrustedSec's COFFLoader, suggesting custom Beacon Object File support. This does not establish Cobalt Strike use.
   • Backdoor versions 1.1.5 and 1.1.7 send JSON containing hostname, username, domain, internal and public IPs, OS, process metadata, architecture and implant details.
   • v1.1.5 contacted dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Connections to file[.]io, gofile[.]io, ably[.]net and ably[.]io were also seen, potentially for C2 tasking.
   • v1.1.7 retrieved encrypted configuration through GitHub infrastructure tied to LatonyCharnleyaW. Files masquerading as JavaScript source maps, README.md and encrypted .ts files appeared to hold configs or further implants.
   • Post-compromise, operators ran Windows net commands for discovery, then used vssadmin.exe to create Volume Shadow Copies and copy ntds.dit.

   Remediation

   • Monitor for suspicious DLL loads, especially trusted binaries loading libraries from unusual directories.
   • Alert on local config file reads immediately before in-memory execution, reflective loading and anomalous executable structures in memory.
   • Correlate unexpected shadow-copy creation with ntds.dit access.
   • Apply application controls and module-load telemetry to catch sideloading.