China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
Summary
A China-aligned threat group called Bronze Sandcastle has been observed targeting organizations in Asia and Africa since mid-2025. The group's notable technique involves using Sandboxie DLL sideloading to deploy backdoors on compromised systems.
IFF Assessment
FOE
The discovery of a new threat actor using sophisticated techniques like DLL sideloading represents an increased risk to defenders.
Defender Context
Defenders should be aware of the Bronze Sandcastle threat actor and their tactics, techniques, and procedures, particularly the use of Sandboxie DLL sideloading. Monitoring for unusual DLL loading behavior and ensuring systems are protected against known sideloading vulnerabilities is crucial.