Sophos: newly named China-aligned group Bronze Sandcastle has used Sandboxie and other DLL sideloading to plant backdoors at organisations in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea since mid-2025
Sophos researcher Gabor Szappanos described a previously undocumented China-aligned threat cluster, Bronze Sandcastle, in a post published on Tuesday 20 October 2026, according to The Hacker News. Between August 2025 and August 2026 the group's attacks hit victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea, and its activity mostly fits the UTC+8 time zone. Its signature technique is DLL sideloading through legitimate Sandboxie executables (SandboxieWUAU.exe loading a malicious sbiedll.dll), plus seven other pairs including NVDA's NvdaHelper.exe, a Java Chromium Embedded Framework helper and Sysinternals bginfo64.exe. The sideloaded DLLs decrypt and run a backdoor kept in an encrypted config.ini file, which collects network and user account details, system information, running processes, keystrokes and screenshots; Sophos has seen versions 1.1.5 and 1.1.7. Version 1.1.5 used dc.cathaypacifice[.]com and net.dpworldto[.]com for command and control, version 1.1.7 pulled encrypted configuration through the GitHub API from a now-removed account, and the payload also talks to file-sharing and messaging services such as file[.]io, gofile[.]io and ably. Sophos says static file detections may miss the encrypted payloads and recommends watching for DLLs that read a local file and immediately execute code in memory. Wire: The Hacker News (21 Oct), citing Sophos.
- Product
- Windows hosts; abused Sandboxie, NVDA, Java CEF helper and Sysinternals BgInfo executables (DLL sideloading)
- Versions
- n/a — threat group / backdoor (payload versions 1.1.5 and 1.1.7; activity August 2025 to August 2026)
- Exploited in Australia?
- unknown
- Patch to
- Organisations with offices or partners in South-East and East Asia: hunt for Sandboxie, NVDA, BgInfo or CEF helper executables in unusual folders (often renamed) next to sbiedll.dll, NvdaHelperRemote.dll, snmpapi.dll or libcef.dll, and for config.ini files read by a DLL that then runs code in memory; block cathaypacifice[.]com and dpworldto[.]com; review outbound traffic to file[.]io, gofile[.]io and ably from servers and workstations that do not need them. Use application allow-listing to stop signed tools running from user-writable paths.
Primary: The Hacker News — China-aligned Bronze Sandcastle abuses Sandboxie DLL sideloading to deploy backdoors (21 Oct 2026) · Vendor: Sophos — Bronze Sandcastle threat profile