Sophos's Counter Threat Unit has designated a new espionage cluster, BRONZE SANDCASTLE, after investigating incidents between August 2025 and August 2026 with victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. The group's consistent marker is DLL sideloading of a malicious sbiedll.dll alongside legitimate Sandboxie binaries, with sideload pairs also abusing javaw.exe/jli.dll, Krita.exe/Krita.dll and NvdaHelper.exe/NvdaHelperRemote.dll; the DLLs read encrypted config.ini payloads, minimising static artefacts. The decrypted payload is a reflective loader Sophos describes as structurally similar to Metasploit's stageless Meterpreter shellcode but not a standard MSF artefact — it uses non-ROR13 API hashing — and it carries COFFLoader elements suggesting custom Beacon Object Files; versions 1.1.5 and 1.1.7 beacon a JSON block of host, process and network detail to command and control, and 1.1.7 pulls encrypted configs from a GitHub repository. Operators enumerate the network with Windows net commands and create Volume Shadow copies to copy ntds.dit, the Active Directory credential database. Activity concentrated in UTC+8 working hours is what Sophos cites in attributing the group to China. Why it matters: fresh tradecraft against Asia-Pacific government and critical-sector targets, where only memory-based detection is reliable.

• Source article