BRONZE SANDCASTLE deploys modified Meterpreter shells

As cited

Copy frozen at 2026-10-20 16:36 UTC (site build).

threat intel

BRONZE SANDCASTLE deploys modified Meterpreter shells

BRONZE SANDCASTLE, a China-based threat group, deploys modified Meterpreter shells through DLL sideloading attacks. The group leverages this technique to establish command and control on compromised systems.

Why it matters: Organizations in sectors targeted by Chinese state-sponsored groups should hunt for DLL sideloading indicators and unsigned Meterpreter instances to detect and contain active intrusions.

Source published

2026-10-20 00:00 UTC

First seen by Cybersecurity Tracker

2026-10-20 15:36 UTC