Skip to content
Hacker Posts

Bronze Sandcastle abuses Sandboxie sideloading for backdoors

Sophos details a China-aligned cluster, Bronze Sandcastle, that sideloads a malicious sbiedll.dll via legitimate Sandboxie binaries to run in-memory Meterpreter and steal ntds.dit.

Published 2 min read
threat-intelbronze-sandcastlechinasandboxie

Sophos has detailed a previously undocumented, China-aligned espionage cluster it calls Bronze Sandcastle, whose signature move is DLL sideloading through Sandboxie — the sandboxing tool Sophos itself open-sourced in 2020. The Sophos research (author Gabor Szappanos) covers activity from August 2025 to August 2026 against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and — "likely" — South Korea.

The technique

A legitimate Sandboxie executable (SandboxieWUAU.exe) loads a malicious sbiedll.dll, which decrypts a config.ini payload and runs a modified Meterpreter shell in memory — no additional disk artifact. The config-backed backdoor enumerates the local network and accounts, collects system metadata, running processes, keystrokes, and screenshots. Two versions were seen, 1.1.5 and 1.1.7; the newer one pulls its encrypted config from a now-removed GitHub account via the API.

Sophos lists eight sideloading pairs. Verbatim:

SandboxieWUAU.exe  <- sbiedll.dll
javaw.exe          <- jli.dll
Krita.exe          <- Krita.dll
NvdaHelper.exe     <- NvdaHelperRemote.dll
Jcef_helper.exe    <- Libcef.dll
Vmmap.exe          <- version.dll
LineAppMgr.exe     <- msvcp140.dll
bginfo64.exe       <- snmpapi.dll

Infrastructure published by Sophos:

v1.1.5 C2:       dc.cathaypacifice[.]com, net.dpworldto[.]com
Tasking (shared): file[.]io, gofile[.]io, ably[.]net, ably[.]io
v1.1.7 config:   github[.]com/LatonyCharnleyaW (API, now inaccessible)

What they do with access

Post-compromise, Sophos observed network and account enumeration followed by creation of Volume Shadow Copies and copying of ntds.dit — the Active Directory database — which puts entire domain credential sets at risk.

Attribution — hedged

Sophos created a new designation because the activity overlaps in targeting with the China-nexus clusters it calls Bronze President and Bronze Atlas but could not be reliably linked to either. Its reasoning for a China-based origin is behavioral: activity concentrated in the UTC+8 time zone. That is an inference, not a government or court attribution.

Action checklist

  1. Alert on legitimate signed binaries (Sandboxie, Krita, NVDA, LINE, Sysinternals Vmmap/bginfo64) loading a same-directory DLL that then reads a local file and executes in memory. Sophos warns static file-based detection is weak here because payloads decode at runtime.
  2. Block or alert on the C2 and tasking domains above, and monitor for AD database access via Volume Shadow Copy abuse (vssadmin, raw ntds.dit reads).
  3. Treat the GitHub-as-config pattern as a detection opportunity: server workloads reaching api.github.com for raw config are worth a look.

Context

Abusing Sandboxie for sideloading is not new — APT41 used a Sandboxie-signed taskhost.exe to load a malicious sbiedll.dll and drop MoonWalk in July 2024. Bronze Sandcastle industrializes the idea across eight clean applications, which is why Sophos's guidance leans on behavior, not hashes.

Related stories