● Covered by 1 source · 1 reportMedium impact1 neutral
China-Aligned Bronze Sandcastle Group Uses Sandboxie DLL Sideloading for Backdoors
Key points
- Bronze Sandcastle is a China-aligned threat group active since mid-2025.
- The group consistently uses Sandboxie DLL sideloading as a primary technique.
- Victims include organizations in the Philippines, Taiwan, Afghanistan, Namibia, and South Korea.
- DLL sideloading allows malicious code to run via trusted applications, evading security software.
New Threat Group Identified
Cybersecurity researchers have uncovered a previously undocumented China-aligned threat cluster named Bronze Sandcastle. This group has been observed targeting organizations in Asia and Africa since mid-2025, with activity noted between August 2025 and August 2026.
Sandboxie DLL Sideloading
The most distinguishing technical characteristic of Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading. This method involves placing legitimate Sandboxie executables in victim environments alongside a malicious "sbiedll.dll" file. This causes the trusted application, "SandboxieWUAU.exe", to load attacker-controlled code during runtime.
How DLL Sideloading Works
DLL sideloading is an adversarial technique that exploits the way Windows loads Dynamic Link Library (DLL) files. When an application launches and requires a DLL without a full path specified, the operating system searches for it in a predetermined sequence of directories. Attackers can place a malicious DLL with the same name as a legitimate one in a directory that Windows searches earlier, causing the legitimate application to load and execute the malicious file.
Impact and Evasion
Because the malicious code is executed by a trusted and often digitally signed application, it is less likely to be flagged by antivirus software and other security solutions. If the legitimate application runs with elevated privileges, the malicious DLL inherits those same permissions, allowing the attacker to perform sensitive actions. This technique also enables persistence if the compromised application is configured to run automatically upon system reboot.
Victims and Other Exploits
Attacks by Bronze Sandcastle have impacted victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. The group is most active in the UTC+8 time zone. Besides Sandboxie, Bronze Sandcastle has used seven other DLL sideloading combinations, including with javaw.exe (Java application) and Krita.exe (Krita digital painting).
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Cybersecurity researchers identified Bronze Sandcastle, a China-aligned threat group active since mid-2025, which uses Sandboxie DLL sideloading to deploy backdoors. This technique exploits how Windows loads DLLs, allowing malicious code to run with the privileges of legitimate applications and evade detection.