Researchers from Sophos have identified a China-aligned threat cluster, tracked as Bronze Sandcastle, exploiting Sandboxie DLL sideloading to deploy backdoors. The campaign has been active since mid-2025 and targets organizations across Asia and Africa. The attack leverages legitimate Sandboxie processes to load malicious DLLs, bypassing security controls.

What should defenders do?

Update Sandboxie to the latest available version. Apply application whitelisting to prevent unauthorized DLL loading. Monitor for unusual process behavior involving Sandboxie executables loading DLLs from unexpected paths. Implement network segmentation to limit the impact of potential backdoor communications.

highMalware

China-Aligned Threat Cluster Bronze Sandcastle Exploits Sandboxie DLL Sideloading for Backdoor Deployment

Sophos researchers detail campaign targeting organizations in Asia and Africa since mid-2025

Cyber.TechVoidPublished about 3 hours agoUpdated less than a minute ago1 min read

China-Aligned Threat Cluster Bronze Sandcastle Exploits Sandboxie DLL Sideloading for Backdoor Deployment

Key Takeaways

Sophos researchers have identified a China-aligned threat cluster named Bronze Sandcastle.
The cluster exploits Sandboxie DLL sideloading to deploy backdoors.
Campaigns have been active since mid-2025 targeting organizations in Asia and Africa.
No specific patch has been released; updating Sandboxie is the primary mitigation.

Related Security News

highMalware

LiteLLM Release Pipeline Compromised to Distribute Info-Stealer Malware

The LiteLLM project's release pipeline was compromised, resulting in the publication of a malicious PyPI package and Docker images containing an info-stealer payload. The malware is designed to steal credentials, secrets, and environment variables from systems that pull the compromised artifacts.

BleepingComputerabout 1 hour ago1 min read

highCyber Attacks

Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

Unknown threat actors breached TeamUpdraft's website and gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. The stolen keys were subsequently used to plant backdoors on WordPress sites. UpdraftPlus, the flagship backup plugin with over four million active installations, is among the affected products. TeamUpdraft has not yet released an official statement confirming the full scope of the breach or the specific exploitation methods employed.

The Hacker Newsabout 2 hours ago1 min read