New research published by Sophos CTU and Sophos Labs has exposed the activities of BRONZE SANDCASTLE, a China-linked threat group that is successfully compromising organizations across Asia and Africa. Between August 2025 and August 2026, the group carried out a series of targeted attacks, focusing on specific regional interests. Victims have been identified across several nations, including the Philippines, Taiwan, Afghanistan, and Namibia, with strong indications of activity also occurring within the Republic of Korea.[1]
Unlike traditional malware campaigns that rely on custom-built malicious executables, BRONZE SANDCASTLE weaponizes legitimate, trusted applications. By operating under the cover of reputable software, the attackers can evade many standard security controls that typically flag unknown or unsigned binaries.
The core of the BRONZE SANDCASTLE operation revolves around a technique known as DLL sideloading. Sophos investigators observed the threat actors frequently abusing the open-source program Sandboxie. By placing a malicious dynamic link library (DLL) file in the same directory as a legitimate application, the attackers trick the system into loading their code rather than the intended library.
This process allows the threat group to run attacker-controlled code under the guise of a trusted process. Once the application executes, it unintentionally triggers the malicious payload, which then downloads and runs encrypted backdoors. This approach is particularly effective because security software often grants higher trust levels to known, legitimate applications, potentially allowing the malicious activity to persist unnoticed within the system’s memory.
The research highlights a significant challenge for modern security teams: the reliance on static, file-based detection methods is becoming increasingly insufficient. Because BRONZE SANDCASTLE payloads are encrypted and decoded only in memory at runtime, traditional antivirus solutions that scan files on disk often fail to detect the threat.
The findings stress that security teams must shift their focus. Defenders should look beyond the application's reputation and instead conduct a more rigorous examination of in-memory behavior. Monitoring the specific files that applications load during startup is a critical step in identifying the unauthorized behavior inherent in DLL sideloading.
Sophos advises that organizations should implement strict endpoint detection and response (EDR) solutions that monitor process-memory behaviors rather than relying solely on file signatures. By focusing on execution patterns rather than static file properties, security teams can better identify these sophisticated backdoors, even when they are hidden behind the façade of otherwise benign, everyday software.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/chinese-threat-group-exploits-trusted-software-applications-9859.html
Comments