A China-based hacking group has spent the past year hiding a custom backdoor behind legitimate copies of Sandboxie, a sandboxing tool, in attacks on organizations across Asia and Africa. The Sophos Counter Threat Unit (CTU) Research Team and researcher Gabor Szappanos have named the cluster BRONZE SANDCASTLE.
Sophos says the group's targeting overlaps with that of the China-based groups BRONZE PRESIDENT and BRONZE ATLAS, but the activity could not be reliably linked to either and carries its own distinctive tooling, which is why it earned a separate name. Across incidents between August 2025 and August 2026, CTU researchers found victims in the Philippines, Taiwan, Afghanistan and Namibia, and likely also South Korea.
A trusted Sandboxie file loads the attacker's code
The group's signature move is DLL sideloading: placing a legitimate program next to a malicious DLL carrying the name it expects, so the trusted program loads attacker code when it runs. Across multiple victims, BRONZE SANDCASTLE paired genuine Sandboxie executables (sometimes renamed, for example as Start.exe) with a malicious sbiedll.dll. It also abused other legitimate software, including a Java launcher (javaw.exe with jli.dll), the Krita painting app, the NVDA screen reader, a LINE messaging app component, and the Sysinternals VMMap and BgInfo utilities.
The sideloaded DLLs read an encrypted config.ini file and run its contents in memory, which keeps extra artifacts off disk and lets operators change behavior without swapping binaries. The DLL code is also obfuscated with a flattened control flow driven by a state machine, which makes static analysis harder.
Meterpreter-like, but not off the shelf
The decrypted payload is a backdoor wrapped in a reflective loader. Sophos says it resembles stageless Metasploit shellcode in structure, but uses non-standard API hashing instead of Metasploit's well-known ROR13 routine and is significantly larger and more complex. It also contains elements of the open-source COFFLoader project, suggesting the author built custom Beacon Object Files for post-exploitation features, and in-memory strings point to data-stealing functions.
Sophos identified payload versions 1.1.5 and 1.1.7. On launch, the implant sends its operators a JSON profile of the host, including hostname, username, domain, OS version, internal and public IP addresses and a process list. Version 1.1.5 contacted the command-and-control domains dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Version 1.1.7 pulled encrypted config files from a GitHub account with little history at hxxps://api[.]github[.]com/repos/LatonyCharnleyaW. Some payloads also reached out to legitimate services such as file[.]io, gofile[.]io and ably[.]io, possibly to receive tasking.
After landing, the operators ran Windows net commands to enumerate the network and user accounts, then created Volume Shadow Copies with vssadmin.exe before copying ntds.dit, the Active Directory database that holds domain credentials. Activity peaks during UTC+8 working hours, which Sophos says reinforces the China-based attribution. It is the latest in a run of China-linked operations that hide inside trusted software, after a backdoor concealed inside trusted apps reported last month.
Hunt in memory, not on disk
Because payloads and configuration files stay encrypted until runtime, Sophos warns that static file detections may be ineffective. It recommends that defenders:
- Watch for DLLs that read a local file and immediately execute code in memory.
- Collect endpoint and memory telemetry and alert on reflective loading, anomalous in-memory PE headers and position-independent shellcode execution.
Based on the activity Sophos describes, it is also worth checking for Sandboxie, Krita, NVDA or Sysinternals binaries running from unexpected folders next to a config.ini file, and treating vssadmin shadow copy creation followed by ntds.dit access as a probable credential theft attempt.
Sophos detects the activity as ATK/Swrort-Y, ATK/ScLoad-W through ATK/ScLoad-Z, Troj/Loader-JL and Troj/Loader-JP, and has published the full indicator list in the SophosLabs GitHub repository. Sophos credits Colin Cowie, Jordon Olness and Morgan Demboski for additional analysis. A group that rotates through nine trusted programs to load one backdoor is betting that defenders trust a file because of its name, and memory telemetry is where that bet can be lost.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.