BRONZE SANDCASTLE (suspected China-based) uses Sandboxie DLL sideloading and custom backdoors to steal Active Directory ntds.dit
BRONZE SANDCASTLE is a suspected China-based intrusion set. Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. Its operators sideload malicious DLLs into legitimate applications, then run encrypted payloads in memory. After deployment they enumerate accounts and steal the Active Directory database (ntds.dit) through Volume Shadow Copies. SophosLabs researchers gave the activity a separate designation because the tooling could not be reliably tied to established groups. Activity clustered in UTC+8 working hours, which supports the China-based assessment. Geographic overlap with BRONZE PRESIDENT and BRONZE ATLAS is not enough to show shared operators.
Technical Details
- The signature technique is abuse of Sandboxie executables (e.g. SandboxieWUAU.exe, a renamed Start.exe) to load an attacker-controlled sbiedll.dll (T1574.001). Other abused programs include Java (javaw.exe with a malicious jli.dll), Krita, NVDA, LINE and Sysinternals utilities.
- A recovered archive, aez.zip, held javaw.exe, malicious jli.dll and an encrypted config.ini. The DLL reads and decodes the config, then transfers execution into memory. Keeping the payload separate from the loader lets operators change functionality without replacing the DLL.
- The loader uses flattened control flow built on a virtualized state machine, with byte swapping, rotations, inversion and negation feeding indirect jump tables. It resembles stageless Metasploit payloads but uses custom API hashing.
- The decoded payload is a position-independent reflective loader that loads an embedded executable in memory. It contains elements tied to TrustedSec's COFFLoader, suggesting custom Beacon Object File support. This does not establish Cobalt Strike use.
- Backdoor versions 1.1.5 and 1.1.7 send JSON containing hostname, username, domain, internal and public IPs, OS, process metadata, architecture and implant details.
- v1.1.5 contacted dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Connections to file[.]io, gofile[.]io, ably[.]net and ably[.]io were also seen, potentially for C2 tasking.
- v1.1.7 retrieved encrypted configuration through GitHub infrastructure tied to LatonyCharnleyaW. Files masquerading as JavaScript source maps, README.md and encrypted .ts files appeared to hold configs or further implants.
- Post-compromise, operators ran Windows net commands for discovery, then used vssadmin.exe to create Volume Shadow Copies and copy ntds.dit.
Remediation
- Monitor for suspicious DLL loads, especially trusted binaries loading libraries from unusual directories.
- Alert on local config file reads immediately before in-memory execution, reflective loading and anomalous executable structures in memory.
- Correlate unexpected shadow-copy creation with ntds.dit access.
- Apply application controls and module-load telemetry to catch sideloading.
Linha do tempo
-
BRONZE SANDCASTLE (suspected China-based) uses Sandboxie DLL sideloading and custom backdoors to steal Active Directory ntds.dit
ler a análise desta fonte ocultar
BRONZE SANDCASTLE is a suspected China-based intrusion set. Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. Its operators sideload malicious DLLs into legitimate applications, then run encrypted payloads in memory. After deployment they enumerate accounts and steal the Active Directory database (ntds.dit) through Volume Shadow Copies. SophosLabs researchers gave the activity a separate designation because the tooling could not be reliably tied to established groups. Activity clustered in UTC+8 working hours, which supports the China-based assessment. Geographic overlap with BRONZE PRESIDENT and BRONZE ATLAS is not enough to show shared operators.
Technical Details
- The signature technique is abuse of Sandboxie executables (e.g. SandboxieWUAU.exe, a renamed Start.exe) to load an attacker-controlled sbiedll.dll (T1574.001). Other abused programs include Java (javaw.exe with a malicious jli.dll), Krita, NVDA, LINE and Sysinternals utilities.
- A recovered archive, aez.zip, held javaw.exe, malicious jli.dll and an encrypted config.ini. The DLL reads and decodes the config, then transfers execution into memory. Keeping the payload separate from the loader lets operators change functionality without replacing the DLL.
- The loader uses flattened control flow built on a virtualized state machine, with byte swapping, rotations, inversion and negation feeding indirect jump tables. It resembles stageless Metasploit payloads but uses custom API hashing.
- The decoded payload is a position-independent reflective loader that loads an embedded executable in memory. It contains elements tied to TrustedSec's COFFLoader, suggesting custom Beacon Object File support. This does not establish Cobalt Strike use.
- Backdoor versions 1.1.5 and 1.1.7 send JSON containing hostname, username, domain, internal and public IPs, OS, process metadata, architecture and implant details.
- v1.1.5 contacted dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Connections to file[.]io, gofile[.]io, ably[.]net and ably[.]io were also seen, potentially for C2 tasking.
- v1.1.7 retrieved encrypted configuration through GitHub infrastructure tied to LatonyCharnleyaW. Files masquerading as JavaScript source maps, README.md and encrypted .ts files appeared to hold configs or further implants.
- Post-compromise, operators ran Windows net commands for discovery, then used vssadmin.exe to create Volume Shadow Copies and copy ntds.dit.
Remediation
- Monitor for suspicious DLL loads, especially trusted binaries loading libraries from unusual directories.
- Alert on local config file reads immediately before in-memory execution, reflective loading and anomalous executable structures in memory.
- Correlate unexpected shadow-copy creation with ntds.dit access.
- Apply application controls and module-load telemetry to catch sideloading.