Bronze Sandcastle

China-Aligned Threat Cluster Bronze Sandcastle Exploits Sandboxie DLL Sideloading for Backdoor Deployment

Researchers from Sophos have identified a China-aligned threat cluster, tracked as Bronze Sandcastle, exploiting Sandboxie DLL sideloading to deploy backdoors. The campaign has been active since mid-2025 and targets organizations across Asia and Africa. The attack leverages legitimate Sandboxie processes to load malicious DLLs, bypassing security controls.