BRONZE SANDCASTLE deploys modified Meterpreter shells
Summary
The China-based threat group BRONZE SANDCASTLE has been observed deploying modified Meterpreter shells. This new tactic involves the use of DLL sideloading in their attacks.
IFF Assessment
FOE
The deployment of modified Meterpreter shells by a known threat actor indicates advanced malicious techniques being used to compromise systems, posing a direct threat to defenders.
Defender Context
Defenders should be aware of BRONZE SANDCASTLE's adoption of DLL sideloading with modified Meterpreter shells. This suggests a need to enhance endpoint detection and response (EDR) capabilities to identify unusual DLL loading patterns and ensure robust anti-malware signatures are in place to detect modified Meterpreter variants.