Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal Active Directory data.
A China-based hacking group is using legitimate Windows applications to load encrypted backdoors onto organisations’ systems in Asia and Africa, according to research from Sophos CTU and Sophos Labs.
Researchers tracked BRONZE SANDCASTLE activity between August 2025 and August 2026, identifying victims in the Philippines, Taiwan, Afghanistan and Namibia, with South Korea also considered a likely victim location.
Sandboxie, software designed to run applications in an isolated environment, appeared repeatedly in the attacks. The operators placed a legitimate Sandboxie executable alongside a malicious DLL, which it loaded when launched. The research does not report a compromise of Sandboxie’s website or official downloads.
Legitimate Software Loads Encrypted Payloads
According to Sophos’ research shared with Hackread.com, the group used DLL sideloading to execute its malware. Other abused applications included Java, Krita, NVDA, LINE, and Sysinternals utilities.
When the legitimate program starts, the malicious DLL opens config.ini, decrypts the backdoor stored inside and runs it in memory. The attackers can update that file to change what the backdoor does without replacing the DLL. Since the payload stays encrypted on disk, file scans may miss code that becomes visible only when it runs.
Backdoors Collect System Details and Support Credential Theft
Sophos identified payload versions 1.1.5 and 1.1.7, describing a modified Meterpreter-based backdoor with custom loading behaviour. Once running, it collects host and process information and communicates with command servers. Version 1.1.7 also retrieved encrypted configuration files from GitHub repositories.
After gaining access, operators examined networks and user accounts. Researchers also observed them creating Windows Volume Shadow Copies and copying ntds.dit, the Active Directory database containing domain account information and password hashes.
Sophos Keeps Attribution Separate From Similar Campaigns
Although other groups including BRONZE PRESIDENT (aka HoneyMate and Mustang Panda)target similar locations, Sophos could not reliably connect their activity to BRONZE SANDCASTLE. Its repeated use of Sandboxie sideloading helped researchers distinguish the group’s operations.
Organisations checking for these attacks should examine what recognised applications load and execute, including unexpected libraries and encrypted files followed by activity in memory. Trusting an executable’s name or origin alone leaves the malicious components it launches unchecked.
