Check your systems for Bronze Sandcastle malware using Sandboxie flaws

Organisations in Asia and Africa face increased risk from a threat cluster known as Bronze Sandcastle, which has targeted networks since mid-2025. This China-aligned group exploits legitimate Windows applications to install encrypted backdoors, allowing them to collect system information and steal Active Directory credentials. Users in affected regions should verify their system integrity immediately.

Who is targeted by this campaign?

Bronze Sandcastle has focused its operations on organisations located in Asia and Africa. Evidence gathered by researchers indicates victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. The group appears most active during the UTC+8 time zone, suggesting a specific operational rhythm. Attacks have continued between August 2025 and August 2026, showing sustained interest in these geographic regions.

How does the malware bypass security?

The attackers use a technique called DLL sideloading to trick the operating system into running malicious code. When a legitimate application launches, it requires specific library files to function. If the application does not specify the full path to these files, Windows searches predetermined directories. Attackers plant a malicious file with the same name in a folder that Windows checks first, causing the trusted program to load the malware instead.

Why is this method effective?

Because the malicious code runs under the guise of a trusted, digitally signed application, it often evades detection by antivirus software and other security solutions. If the legitimate application runs with elevated privileges, the malicious code inherits those same permissions. This allows the attacker to perform sensitive actions on the system. Furthermore, if the compromised application is set to run automatically at startup, the malware achieves persistence on the infected host.

What specific software is being abused?

Sophos researchers identified the consistent use of Sandboxie DLL sideloading as the most distinctive marker for Bronze Sandcastle. The group places legitimate Sandboxie executables alongside a malicious file named sbiedll.dll. This causes the trusted application SandboxieWUAU.exe to load attacker-controlled code during runtime. Beyond Sandboxie, the group has leveraged seven other combinations, including using Krita.exe to load a malicious Krita.dll file.

What affected people can do

Teams should review their endpoint logs for unusual DLL loading events, particularly involving legitimate applications like Sandboxie or Krita. Check whether any trusted programs are running from unexpected directories or loading libraries from non-standard paths. Look for signs of encrypted backdoors or unexpected network connections originating from these applications. Be vigilant for follow-up scams that may attempt to exploit the confusion surrounding this breach, such as fake support calls or phishing emails claiming to offer remediation.

What to do and how to stay safe: Bronze Sandcastle

• Monitor your systems for legitimate applications loading unexpected or modified dynamic link libraries.
• Verify that critical software is installed from official sources and has not been tampered with.
• Review user permissions to ensure applications do not run with elevated privileges unless necessary.
• Watch for suspicious activity in the UTC+8 time zone window if you are in the affected regions.

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Bronze Sandcastle?

Bronze Sandcastle is a previously undocumented, China-aligned threat cluster that has been targeting organisations in Asia and Africa since mid-2025.

How do they install backdoors?

They use DLL sideloading, tricking legitimate Windows applications like Sandboxie and Krita into loading malicious dynamic link libraries instead of the correct ones.

Which countries have been affected?

Victims have been identified in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea, with attacks occurring between August 2025 and August 2026.