China-linked attackers are leveraging trusted Windows applications to load concealed backdoors, collect system information, and steal Active Directory credential data.
The group, tracked as BRONZE SANDCASTLE, places malicious libraries or files alongside legitimate software so that the authentic programs load attacker-controlled code without altering the original application binaries.
This campaign illustrates how legitimate software can be repurposed in an attack chain. Similar China-linked DLL sideloading operations have abused trusted applications to conceal malicious activity, though shared techniques do not by themselves prove a direct link between different threat groups.
Researchers in Sophos’ Counter Threat Unit and SophosLabs discovered the malware while investigating incidents across Asia and Africa. Their technical report, published on October 20, covers attacks observed between August 2025 and August 2026 affecting victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea.
Trusted Windows applications used to sideload DLLs
Sandboxie DLL sideloading is the clearest technical indicator for this group. Operators deployed legitimate Sandboxie executables alongside a malicious supporting DLL. When the trusted application is launched, it loads the malicious library and transfers execution to the attackers’ code. The report also documents abused components from Java, Krita, NVDA, LINE, and Microsoft Sysinternals.
The malicious libraries typically read an encrypted payload from a local configuration file, decrypt or decode it, and execute the code directly in memory. This separation keeps the visible application distinct from the hidden backdoor and allows operators to change payload behavior without replacing the loader library. Renaming executables also helped the files blend into compromised systems.
Previous ShadowPad DLL sideloading campaigns have used a similar three-part structure — a legitimate executable, a malicious library, and an encrypted payload — which provides context but not definitive attribution. Sophos is tracking BRONZE SANDCASTLE separately because the observed activity could not be reliably tied to groups tracked as BRONZE PRESIDENT or BRONZE ATLAS.
Modified Meterpreter-style payload collects system data
The decoded backdoor employs a reflective loader that places an embedded Windows program into memory. While parts of its structure resemble Metasploit shellcode, Sophos found custom function-resolution routines and a larger, more complex codebase than typical examples. Other elements described as COFFLoader indicate additional custom features intended for post-compromise activity.
Researchers identified payload versions 1.1.5 and 1.1.7. The backdoor reports a structured JSON message to its command server containing computer and user names, domain information, operating system version, internal and public IP addresses, running processes, working directory, processor type, and system uptime.
Version 1.1.5 connected to dedicated control domains, while version 1.1.7 retrieved encrypted configuration files via GitHub. The attackers also made connections to legitimate file‑sharing and messaging services, which may have been used to receive instructions or configuration data, although Sophos did not confirm that purpose.
After gaining access, operators used Windows networking commands to enumerate accounts and local networks. They created Volume Shadow Copies and then copied the Active Directory database (ntds.dit). This sequence links remote access to attempts to obtain sensitive domain credential data — Volume Shadow Copy snapshots can expose otherwise protected database contents.
Sophos recommends monitoring for libraries that read local files and immediately execute code in memory, as well as looking for unusual portable executable headers and reflective loading behavior. Because payloads are often encrypted on disk, behavior-based and memory monitoring are important complements to static file detection.
Indicators of compromise (IoCs)
| Type | Indicator | Context |
|---|---|---|
| Control domains | dc[.]cathaypacifice[.]com ; net[.]dpworldto[.]com | Version 1.1.5 connections |
| Legitimate services observed | file[.]io ; gofile[.]io ; ably[.]net ; ably[.]io ; github[.]com | Observed connections |
| GitHub location | hxxps://api[.]github[.]com/repos/LatonyCharnleyaW | Configuration retrieval |
| Sandboxie pairs | SandboxieWUAU.exe / sbiedll.dll ; Start.exe / sbiedll.dll | DLL sideloading |
| Java pair | javaw.exe / jli.dll | DLL sideloading |
| Krita pair | Krita.exe / Krita.dll | DLL sideloading |
| NVDA pair | NvdaHelper.exe / NvdaHelperRemote.dll | DLL sideloading |
| JCEF pair | Jcef_helper.exe / Libcef.dll | DLL sideloading |
| Sysinternals pairs | Vmmap.exe / Version.dll ; bginfo64.exe / snmpapi.dll | DLL sideloading |
| LINE pair | LineAppMgr.exe / msvcp140.dll | DLL sideloading |
| Local files | aez.zip ; config.ini | Archive and encrypted payload |
| Repository files | main.3ku8inqb.js.map ; main.lhxjkkai.js.map ; main.y8hnze7q.js.map ; README.md ; .ts files | Suspected configurations or implants |
| Credential activity | vssadmin.exe ; ntds.dit ; Windows net commands | Snapshot creation, database copying, discovery |
| Sophos detections | ATK/Swrort-Y ; ATK/ScLoad-W ; ATK/ScLoad-X ; ATK/ScLoad-Y ; ATK/ScLoad-Z ; Troj/Loader-JL ; Troj/Loader-JP | Related protection names |
Note: IP addresses and domains are intentionally defanged (for example, using [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat‑intelligence platforms such as MISP, VirusTotal, or your SIEM.
Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from operational SOCs.
