China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025.

“The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading,” Sophos security researcher Gabor Szappanos said in a post published Tuesday.

Between August 2025 and August 2026, attacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active in the UTC+8 time zone.

DLL sideloading is a popular adversarial technique that exploits the way Windows loads DLL files, allowing an attacker to trick a legitimate program into loading a malicious DLL.

When an application is launched, it needs to load various DLLs in order to function correctly. If the application does not provide the full path to a required DLL, the operating system looks for it in a predetermined sequence of directories.

An attacker can take advantage of this behavior by planting a malicious DLL with the same name as a legitimate one in a location that Windows searches before the folder that contains the actual DLL. Thus, when the legitimate application starts, it proceeds to load and run the malicious DLL, giving the attacker a way in to the system.

“Because the malicious code is executed by a trusted and often digitally signed application, it is less likely to be flagged by antivirus software and other security solutions,” Zscaler noted in an analysis last week.

“If the legitimate application runs with elevated privileges, the malicious DLL will inherit those same permissions, allowing the attacker to perform more sensitive actions on the system.”

What’s more, the technique enables persistence if the compromised application is configured to automatically run every time a system is rebooted, thereby allowing the attacker’s code to execute on the infected host.

Sophos said it observed legitimate Sandboxie executables placed in multiple victim environments, along with a malicious “sbiedll.dll” file, which, in turn, causes the trusted application (“SandboxieWUAU.exe”) to load attacker-controlled code during runtime.

Besides Sandboxie, Bronze Sandcastle has been leveraged in seven other DLL sideloading combinations –

• javaw.exe (Java application) – jli.dll
• Krita.exe (Krita digital painting) – Krita.dll
• NvdaHelper.exe (NVDA NonVisual Desktop Access) – NvdaHelperRemote.dll
• Jcef_helper.exe (Java Chromium Embedded Framework Helper) – Libcef.dll
• Vmmap.exe (Sysinternals process memory analyzer) – version.dll
• LineAppMgr.exe (LINE messaging application) – msvcp140.dll
• bginfo64.exe (Sysinternals utility that displays system information) – snmpapi.dll

“The sideloaded DLLs typically read and execute payloads stored in encrypted config.ini files,” Sophos said. “This design minimizes static detection and allows operators to adjust behavior without replacing DLL binaries. Renamed legitimate executables are frequently used to blend into victims’ environments, with execution resulting in in-memory shellcode activity rather than additional disk artifacts.”

The DLL is designed to load and execute an encrypted payload (“config.ini”), which functions as a backdoor designed to enumerate local network and user accounts, as well as collect system metadata, running processes, keystrokes, and screenshots. Two different versions of the payload have been identified to date: 1.1.5 and 1.1.7.