Bronze Sandcastle APT Exploits Sandboxie DLL Sideloading in New Campaign

Introduction

In a significant development for threat intelligence teams tracking state-sponsored cyber operations, Sophos researchers have pulled back the curtain on a previously unknown China-aligned advanced persistent threat group. Dubbed Bronze Sandcastle, this cluster has been quietly compromising organizations across Asia and Africa since at least mid-2025, employing a novel and highly effective technique that turns a popular sandboxing application into a weapon for stealthy malware delivery.

The discovery, detailed by Sophos security researcher Gabor Szappanos, reveals a threat actor that has refined the art of DLL sideloading by targeting Sandboxie—a legitimate application designed to isolate programs from the underlying operating system. By exploiting the trust placed in this security tool, Bronze Sandcastle has managed to deploy persistent backdoors while flying under the radar of conventional detection mechanisms.

Anatomy of the Sandboxie DLL Sideloading Technique

DLL sideloading is a well-documented adversary technique where attackers place a malicious dynamic-link library alongside a legitimate executable, tricking the application into loading the attacker's code instead of—or alongside—the authentic library. What makes Bronze Sandcastle's approach distinctive is the choice of carrier application.

• Target Application: Sandboxie, a widely used sandboxing utility that creates isolated environments for running untrusted programs.
• Mechanism: The attackers drop a malicious DLL named identically to a legitimate Sandboxie dependency into the application's directory.
• Execution Flow: When Sandboxie launches—either by user action or via persistence mechanisms—the Windows DLL search order causes the malicious library to load first.
• Payload Delivery: The sideloaded DLL acts as a loader, decrypting and injecting a backdoor payload into memory without touching disk.

This approach offers several tactical advantages. Sandboxie is often whitelisted by application control policies due to its legitimate security purpose. Its presence on a system raises fewer eyebrows than unknown executables, and its normal operation involves injecting code into other processes—behavior that mirrors malicious injection techniques, providing effective cover.

Operational Timeline and Geographic Targeting

Telemetry analysis places Bronze Sandcastle's earliest confirmed activity in June 2025, with consistent operations observed through the remainder of the year. The targeting pattern reveals strategic intent:

• Primary Regions: Southeast Asia, South Asia, and East Africa
• Sector Focus: Government agencies, telecommunications providers, and logistics organizations
• Victim Profile: Entities involved in regional infrastructure projects and cross-border data flows

The geographic and sectoral alignment strongly suggests intelligence collection objectives consistent with Chinese state priorities, particularly around Belt and Road Initiative corridors and maritime domain awareness. Unlike financially motivated ransomware groups, Bronze Sandcastle exhibits the patience and operational security hallmarks of a dedicated espionage unit.

Technical Indicators and Detection Opportunities

While the sideloading technique is designed for stealth, several artifacts remain detectable with proper monitoring:

• File System Anomalies: Unexpected DLLs in Sandboxie installation directories, particularly those with mismatched digital signatures or recent creation timestamps on otherwise stable systems.
• Process Behavior: Sandboxie processes (SbieSvc.exe, SbieCtrl.exe) spawning unusual child processes or making network connections to previously unseen destinations.
• Memory Artifacts: In-memory modules lacking corresponding disk files—a classic sign of reflective loading or hollow process injection.
• Persistence Mechanisms: Scheduled tasks or Run keys invoking Sandboxie with suspicious arguments, or modified Sandboxie configuration files (Sandboxie.ini) referencing unusual sandbox names.

Organizations should prioritize application allowlisting with hash-based verification, monitor for unsigned DLLs in trusted application directories, and deploy memory scanning capabilities that can detect reflective loading techniques.

Conclusion

The Bronze Sandcastle discovery serves as a stark reminder that adversary innovation continues to outpace signature-based defenses. By hijacking a tool designed to enhance security, this threat actor has demonstrated how the boundary between defensive and offensive utility can be erased with minimal effort. The campaign's focus on strategic targets in Asia and Africa underscores the geopolitical dimensions of modern cyber espionage, where technical sophistication serves statecraft objectives.

As organizations harden their environments against such techniques, the emphasis must shift from static indicators to behavioral analytics, memory forensics, and zero-trust application control. Grivyonx Cloud's AI-driven threat hunting platform helps security teams detect these subtle anomalies by correlating process behavior, memory artifacts, and network telemetry across the enterprise—turning the stealth advantages of techniques like DLL sideloading into detectable signals. Staying ahead of groups like Bronze Sandcastle requires not just better tools, but a fundamental rethinking of what constitutes trusted execution in a compromised world.