Cybersecurity researchers have identified a previously undocumented China-aligned threat cluster that has targeted organizations across Asia and Africa with modified Meterpreter-based backdoors. Sophos’ Counter Threat Unit said the group, tracked as BRONZE SANDCASTLE, has been active since at least mid-2025 and is distinguished by its repeated abuse of legitimate software to load malicious DLLs.
The group’s signature technique involves placing a genuine Sandboxie executable alongside a malicious sbiedll.dll. When SandboxieWUAU.exe or a renamed Sandboxie executable starts, Windows loads the attacker-controlled library. Sophos also observed similar sideloading chains involving Java, Krita, NVDA, Sysinternals utilities and the LINE messaging application. The technique abuses normal DLL search behavior rather than a documented vulnerability, and Sophos reported no associated CVE, CVSS score, security patch or public exploit. [1]
CTU’s review of incidents from August 2025 through August 2026 identified victims in the Philippines, Taiwan, Afghanistan and Namibia, with a likely victim in South Korea. The researchers said the geography and activity patterns are consistent with Chinese intelligence-gathering priorities, while stressing that the cluster could not be reliably linked to other China-based groups such as BRONZE PRESIDENT or BRONZE ATLAS. Activity concentrated in UTC+8 hours, which Sophos said further supports—but does not prove—the China-based assessment.
The sideloaded libraries typically read encrypted payloads from files named config.ini and decode them at runtime. The resulting backdoor executes in memory and incorporates features associated with modified Meterpreter payloads and COFFLoader-derived post-exploitation code. Sophos said the malware can collect host and user details, process information, keystrokes and screenshots, enumerate networks and accounts, and communicate with operator infrastructure through legitimate services and GitHub repositories.
In some intrusions, the operators ran Windows net commands to survey the environment, created Volume Shadow Copies with vssadmin.exe and copied ntds.dit, the Active Directory database that can contain domain credential material. Those actions raise the risk of broader domain compromise even though the initial access method was not tied to a software flaw. The campaign therefore represents an operational threat to organizations using the abused legitimate applications, not a Sandboxie vulnerability requiring a vendor patch.
Defenders should prioritize behavioral and memory telemetry over file signatures alone. Sophos recommends investigating trusted applications that load unexpected DLLs, DLLs that immediately read local encrypted files, reflective-loading behavior and anomalous PE headers or position-independent shellcode in process memory. Organizations in the affected regions should also review endpoint activity for the listed sideloading combinations, suspicious use of vssadmin.exe and access to ntds.dit, while using Sophos’ technical report and threat profile to support hunting. [1]
