Search — “Bronze Sandcastle”

Sophos researchers disclosed Bronze Sandcastle, a China-aligned espionage cluster active since mid-2025 against victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. The group abuses DLL sideloading via legitimate Sandboxie executables (SandboxieWUAU.exe loading a malicious sbiedll.dll) and seven other signed binaries, with sideloaded DLLs decrypting a config.ini payload and executing shellcode in memory. Hunters should look for signed binaries loading unexpected DLLs from non-standard paths, DLLs reading local files followed by immediate in-memory execution, and payloads beaconing to file.io, gofile.io, ably.net or GitHub API endpoints.