Cybersecurity researchers at **Sophos** have unveiled details of a persistent and stealthy threat actor, **Bronze Sandcastle**, which has been operating since mid-2025. This China-linked group has demonstrated a clear focus on targets across Asia and Africa, employing a distinct technical marker: consistent use of **Sandboxie** DLL sideloading. According to **Sophos** security researcher Gabor Szappanos, the group's activities between August 2025 and August 2026 have resulted in successful compromises in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea, with evidence suggesting the group is most active during the UTC+8 time zone. ### The Deceptive Power of DLL Sideloading DLL sideloading is a prevalent adversarial technique that exploits how **Windows** loads dynamic-link library (DLL) files. Attackers can trick a legitimate program into loading a malicious DLL by placing it in a specific directory where the operating system searches before finding the authentic file.  This technique is particularly effective because the malicious code is executed by a trusted, often digitally signed application, making it less likely to be flagged by antivirus software and other security solutions. As **Zscaler** noted, if the legitimate application runs with elevated privileges, the malicious DLL inherits those same permissions, granting the attacker broader control over the system. Furthermore, DLL sideloading can establish persistence. If the compromised application is configured to automatically run upon system reboot, the attacker's code will execute consistently on the infected host. ### Sandboxie: A Trusted Name Turned Malicious Vector **Sophos** observed **Bronze Sandcastle** placing legitimate **Sandboxie** executables, specifically `SandboxieWUAU.exe`, alongside a malicious `sbiedll.dll` file in victim environments. This setup causes the trusted **Sandboxie** application to load the attacker-controlled code during runtime. Beyond **Sandboxie**, **Bronze Sandcastle** has leveraged seven other DLL sideloading combinations: * `javaw.exe` (Java application) - `jli.dll` * `Krita.exe` (**Krita** digital painting) - `Krita.dll` * `NvdaHelper.exe` (**NVDA NonVisual Desktop Access**) - `NvdaHelperRemote.dll` * `Jcef_helper.exe` (Java Chromium Embedded Framework Helper) - `Libcef.dll` * `Vmmap.exe` (**Sysinternals** process memory analyzer) - `version.dll` * `LineAppMgr.exe` (**LINE** messaging application) - `msvcp140.dll` * `bginfo64.exe` (**Sysinternals** utility) - `snmpapi.dll`  ### The Payload: Encrypted Backdoors and Evasion The sideloaded DLLs are designed to read and execute payloads stored in encrypted `config.ini` files. This design minimizes static detection and allows operators to adjust behavior without replacing DLL binaries. Renamed legitimate executables are often used to blend into victim environments, with execution primarily resulting in in-memory shellcode activity rather than additional disk artifacts. The payload itself functions as a sophisticated backdoor, capable of enumerating local network and user accounts, collecting system metadata, listing running processes, capturing keystrokes, and taking screenshots. **Sophos** has identified two versions of this payload: 1.1.5 and 1.1.7. Version 1.1.5 has been observed communicating with `dc.cathaypacifice[.]com` and `net.dpworldto[.]com` for command-and-control (C2). Version 1.1.7, on the other hand, utilizes **GitHub** repositories (`github[.]com/LatonyCharnleyaW`) via the API to download encrypted configuration files, though this **GitHub** account is no longer accessible. ### A Recurring Tactic for Chinese APTs This isn't the first instance of Chinese hacking groups employing DLL sideloading, nor is it the first time **Sandboxie** has been implicated. In July 2024, the **APT41** threat actor leveraged a different executable signed by **Sandboxie** (`taskhost.exe`) to sideload a malicious version of `sbiedll.dll`, ultimately deploying a backdoor known as **MoonWalk**. Organizations are advised to focus on behavioral indicators rather than relying solely on static file-based detections, which may be ineffective against **Bronze Sandcastle**'s use of encrypted payloads. Key indicators include DLLs reading local files followed by immediate in-memory execution, which can signal decoding and staging activity.