China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

As cited

Copy frozen at 2026-10-21 15:51 UTC (site build).

threat intel

China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Sophos researchers disclosed Bronze Sandcastle, a China-aligned threat cluster active since mid-2025, targeting organizations in Asia and Africa. The group's defining technique involves Sandboxie dynamic link library (DLL) sideloading to deploy backdoors.

Why it matters: Organizations in Asia and Africa should assess whether Bronze Sandcastle techniques align with observed intrusions and review DLL sideloading detection in endpoint and application whitelisting controls.

Source published

2026-10-21 12:05 UTC

First seen by Cybersecurity Tracker

2026-10-21 14:47 UTC