{
  "id": 15891898,
  "title": "China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors",
  "url": "https://urgent.news/2026/10/21/china-aligned-bronze-sandcastle-abuses-sandboxie-dll-sideloading-to",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T12:05:00.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html"
  },
  "original_language": "en",
  "account": "Cybersecurity researchers have uncovered a previously unknown China-aligned threat group called Bronze Sandcastle, which has been targeting organizations in Asia and Africa since mid-2025. The group's most notable technique is the use of Sandboxie DLL sideloading. Between August 2025 and August 2026, Bronze Sandcastle carried out attacks against victims in the Philippines, Taiwan, Afghanistan, Namibia, and potentially South Korea. The threat actor primarily operates in the UTC+8 time zone. DLL sideloading is a common adversarial tactic that exploits how Windows loads DLL files, allowing attackers to deceive legitimate applications into loading malicious code. When an application runs, it searches for required DLLs in a specific directory order. Attackers can exploit this by placing a malicious DLL with the same name as a legitimate one in a directory that Windows searches before the actual DLL folder. When the legitimate application starts, it loads and executes the malicious DLL, giving the attacker access to the system. Because the malicious code runs within a trusted application, it is less likely to be detected by antivirus software and other security solutions. The group has also been observed using Sandboxie executables in multiple victim environments, along with a malicious sbiedll.dll file. This malicious DLL causes the trusted application to load attacker-controlled code during runtime. The group has leveraged seven different DLL sideloading combinations, often using renamed legitimate executables to blend in with victims' environments. The malware reads and executes payloads stored in encrypted config.ini files, which minimizes static detection and allows operators to adjust behavior without replacing DLL binaries. The malware is designed to load and execute an encrypted payload, which functions as a backdoor to gather information about the local network and user accounts, running processes, keystrokes, and screenshots. The group has identified two versions of the payload: 1.1.5 and 1.1.7. The 1.1.5 version has communicated with external sites, while the 1.1.7 version has used GitHub repositories to download encrypted config files. This is not the first time Chinese hacking groups have used DLL sideloading or Sandboxie in attacks. In July 2024, the APT41 threat actor used a different Sandboxie-signed executable to deploy a backdoor called MoonWalk. Organizations should focus on behavioral indicators, such as DLLs reading local files followed by immediate in-memory execution, to detect potential attacks.",
  "summary": "Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. \"The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading,\" Sophos security researcher Gabor Szappanos said in a post published",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}