BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor
Do Son 
| At a glance | |
| Malware family | Custom Meterpreter-style backdoor (versions 1.1.5 and 1.1.7) |
| Threat actor | BRONZE SANDCASTLE; suspected China-based |
| Targets | Organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea |
| Delivery vector | DLL sideloading through Sandboxie and other trusted programs |
| Key capabilities | In-memory execution, host profiling, data theft, Active Directory database theft |
| Source | Sophos Counter Threat Unit and SophosLabs |
TL;DR
Sophos researchers have tracked BRONZE SANDCASTLE across victims in Asia and Africa between August 2025 and August 2026. The group’s signature move is Sandboxie DLL sideloading, which loads an encrypted backdoor straight into memory. Sophos suspects the group is China-based.
Delivery
The attackers place a legitimate Sandboxie program next to a malicious DLL. When the trusted program starts, it loads the attacker’s code. Sophos calls this pattern a signature for the group.
BRONZE SANDCASTLE also abuses other trusted tools. These include Java, the Krita painting app, the NVDA screen reader, Sysinternals utilities, and the LINE messaging app. Attackers often rename these files to blend into the victim’s network.
Infection chain
The malicious DLL reads an encrypted config.ini file and decodes it at runtime. As a result, operators can change behavior without swapping the DLL. To slow analysts, the DLL also hides its logic behind a flattened, state-machine dispatcher.
Once decoded, the payload acts as a reflective loader that runs a backdoor in memory. It resembles Metasploit’s Meterpreter. However, Sophos says its hashing routines and much larger codebase show “this loader is not a standard Metasploit artifact.” It also borrows code from the COFFLoader project to run custom add-ons.
Command-and-control and data exfiltration
After launch, the BRONZE SANDCASTLE backdoor sends a JSON profile to its C2 server. This profile includes the host name, user, domain, IP addresses, OS version, and running processes. Some samples contact lookalike domains. Others reach file-sharing and messaging services, possibly for tasking. Version 1.1.7 also downloads encrypted config files from a GitHub repository.
Inside the network, operators run Windows “net” commands to map users and hosts. They then create shadow copies to copy ntds.dit, the Active Directory credential database.
Attribution
Attribution remains suspected. The group’s targets overlap with those of BRONZE PRESIDENT and BRONZE ATLAS. However, Sophos could not reliably link it to either group. Activity also peaks in UTC+8 working hours, which matches China’s “996” schedule.
Defense and detection guidance
Because the payloads stay encrypted on disk, file-based detection may fail. Instead, the Sophos report on BRONZE SANDCASTLE’s modified Meterpreter shells advises defenders to watch for these behaviors:
- A DLL that reads a local file and then runs code in memory right away.
- Sandboxie or other trusted tools running from unusual folders.
- Odd PE headers in memory or reflective loading patterns.
- Shadow copy creation followed by access to ntds.dit.
In short, Sandboxie DLL sideloading gives BRONZE SANDCASTLE a quiet way in, so memory-based monitoring matters most.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
