Bronze Sandcastle Uses Sandboxie and Seven Other Signed Binaries for DLL Sideloading Backdoors

Bronze Sandcastle targets organizations in Asia and Africa using renamed legitimate executables paired with attacker-controlled DLLs. The sideloaded code reads payloads from config.ini files, executes in-memory shellcode, and performs network enumeration, keystroke logging, and screenshot capture. Two payload versions, 1.1.5 and 1.1.7, have been observed communicating with file.io, gofile.io, ably.net, and GitHub repositories for tasking while version 1.1.5 also used dc.cathaypacifice.com and net.dpworldto.com for C2. Sophos documented eight distinct sideloading combinations including javaw.exe with jli.dll, Krita.exe with Krita.dll, and bginfo64.exe with snmpapi.dll. The technique exploits Windows DLL search order to inherit privileges from trusted applications, minimizing static detection and disk artifacts. Activity concentrated in UTC+8 timezone indicates operator location or shift patterns rather than broad global reach. The consistent choice of DLL sideloading over other persistence methods aligns with other China-linked clusters that prioritize stealth against endpoint controls. Public file-hosting services for C2 reduce infrastructure costs but create observable traffic patterns. No direct code reuse with known groups has been confirmed, yet the geographic focus and time zone overlap suggest shared operational priorities. Defenders should monitor for config.ini files and renamed Sysinternals or Java binaries in user directories. Expansion to additional signed applications is likely as known pairs receive detection signatures within the next six months.