Bronze Sandcastle: How China's Newest APT Turns Trusted Apps Into Backdoor Loaders
Executive Summary
Between August 2025 and August 2026, a previously undocumented China-aligned threat cluster tracked as Bronze Sandcastle conducted cyber-espionage campaigns against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and South Korea. The group's signature technique is DLL sideloading via legitimate Sandboxie executables, where a malicious sbiedll.dll is planted alongside trusted, digitally signed binaries to execute attacker-controlled code in memory. Encrypted config.ini payloads deploy a full-featured backdoor capable of keylogging, screenshot capture, network enumeration, and C2 communication over public file-sharing services and GitHub repositories, minimizing static detection and leaving minimal disk artifacts.
Bronze Sandcastle exemplifies a maturing pattern among China-nexus APTs: abusing trusted application ecosystems and living-off-the-land techniques to bypass endpoint defenses. As DLL sideloading variants proliferate across APT41, Mustang Panda, and now Bronze Sandcastle, defenders face mounting pressure to shift from file-based detection toward behavioral monitoring of in-memory execution chains and anomalous outbound traffic.
Why This Matters Now
DLL sideloading by China-aligned threat actors is accelerating in 2025–2026, with Bronze Sandcastle adding to a growing roster of groups exploiting trusted binaries to evade EDR and AV solutions. The use of legitimate cloud services such as GitHub, file.io, and Ably for C2 makes traditional perimeter controls ineffective, demanding network-layer behavioral visibility and egress enforcement as urgent defensive priorities.
Attack Path Analysis
Bronze Sandcastle gained initial access by delivering malicious DLL files alongside legitimate, trusted executables (Sandboxie, Krita, NVDA, etc.) via spearphishing or supply-chain staging, exploiting Windows DLL search-order hijacking (T1574.001) to load attacker-controlled code through signed applications. The sideloaded DLL decoded an encrypted payload (config.ini) entirely in memory, inherited the host process privileges, established persistence via auto-run configurations, enumerated local networks and accounts, communicated with C2 infrastructure including typosquatted domains and GitHub repositories, collected keystrokes and screenshots, and exfiltrated data to file-sharing services (file.io, gofile.io, ably.net) while operators retained long-term espionage access across victims in Asia and Africa.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Bronze Sandcastle delivered malicious DLL files (e.g., sbiedll.dll, Krita.dll, NvdaHelperRemote.dll) alongside legitimate signed executables to victim environments, exploiting Windows DLL search-order hijacking (T1574.001). Because the malicious DLL is loaded by a trusted, often digitally signed process, endpoint defenses were bypassed. Initial delivery vector is consistent with spearphishing attachments or trojanized software packages targeting organizations in the Philippines, Taiwan, Afghanistan, Namibia, and South Korea.
MITRE ATT&CK® Techniques
Hijack Execution Flow: DLL Side-Loading
Command and Scripting Interpreter: Windows Command Shell
Obfuscated Files or Information
Application Layer Protocol: Web Protocols
Input Capture: Keylogging
Screen Capture
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Malicious Code Protection, System Monitoring, and Mobile Code Restrictions
Control ID: SI-3, SI-4, SC-18
CISA Zero Trust Maturity Model 2.0 – Application Execution Control and Device Behavioral Monitoring
Control ID: Applications Pillar – Application Security (Least Privilege Access), Devices Pillar – Device Visibility
NIS2 Directive (EU) 2022/2555 – Supply Chain Security and Incident Detection Obligations
Control ID: Article 21 – Cybersecurity Risk Management Measures
PCI DSS 4.0 – Anti-Malware Controls and Automated Log Review for Anomalies
Control ID: Requirement 5.2, Requirement 10.7
DORA (EU) 2022/2554 – ICT Threat Detection and Resilience Testing
Control ID: Article 9 – ICT Security Policies, Article 10 – Detection Capabilities
ISO/IEC 27001:2022 – Vulnerability Management and Operational Monitoring
Control ID: Annex A 8.8 – Management of Technical Vulnerabilities, Annex A 8.16 – Monitoring Activities
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Bronze Sandcastle's China-aligned cyber espionage campaign targeting Asia-Pacific nations directly threatens government agencies via DLL sideloading backdoors enabling lateral movement, data exfiltration, and persistent C2 communications against sovereign infrastructure.
Defense/Space
State-sponsored Bronze Sandcastle backdoor deployments using encrypted payloads and Sandboxie sideloading pose critical exfiltration risks to defense organizations, with compliance gaps across NIST 800-53 SC-7 and Zero Trust segmentation controls.
Information Technology/IT
IT environments running Java, Sysinternals, and LINE application stacks are directly exploited via DLL sideloading; validated controls for east-west traffic security and multicloud visibility are critical to detecting in-memory shellcode activity.
Telecommunications
Bronze Sandcastle's C2 channels mimicking legitimate traffic and encrypted config exfiltration mirror Salt Typhoon TTPs, exposing telecom providers to undetected long-dwell espionage requiring MACsec encryption and egress policy enforcement.
Sources
- China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoorshttps://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.htmlVerified
- Bronze Sandcastle Deploys Modified Meterpreter Shells - Sophos Research Bloghttps://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shellsVerified
- MITRE ATT&CK T1574.001 - Hijack Execution Flow: DLL Side-Loadinghttps://attack.mitre.org/techniques/T1574/001/Verified
- Sophos - Family Tree: DLL Sideloading Cases May Be Relatedhttps://www.sophos.com/en-us/blog/family-tree-dll-sideloading-cases-may-be-relatedVerified
- Zscaler - Uncover DLL Sideloading Attacks with Endpoint Contexthttps://www.zscaler.com/blogs/product-insights/uncover-dll-sideloading-attack-endpoint-contextVerified
- Google Cloud Threat Intelligence - Abusing DLL Misconfigurationshttps://cloud.google.com/blog/topics/threat-intelligence/abusing-dll-misconfigurationsVerified
- Chinese APT41 Upgrades Malware Arsenal - The Hacker Newshttps://thehackernews.com/2024/07/chinese-apt41-upgrades-malware-arsenal.htmlVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Darktrace - Chinese APT Target Royal Thai Police in Malware Campaignhttps://www.darktrace.com/blog/chinese-apt-target-royal-thai-police-in-malware-campaignVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because Bronze Sandcastle relied heavily on unrestricted east-west reachability, uncontrolled egress to cloud-hosted services, and permissive outbound paths to sustain a multi-year espionage campaign. By enforcing workload-level segmentation and identity-aware egress policies across the cloud fabric, Aviatrix would likely have reduced the attacker's ability to pivot, beacon, and exfiltrate without triggering policy boundaries.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Even where endpoint compromise occurs, CNSF fabric-level visibility could likely reduce the reachability of newly compromised workloads by flagging unexpected outbound connection attempts from processes that would not normally initiate cloud-facing traffic, constraining how far that initial foothold can reach into adjacent cloud-hosted environments.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the operational scope available to an elevated process by enforcing that even privileged workloads operate within identity-scoped access boundaries, reducing the range of cloud resources or adjacent workloads that a privilege-inherited backdoor could directly reach or interact with.
Control: East-West Traffic Security
Mitigation: East-west enforcement policies would likely constrain the attacker's ability to pivot between workloads by blocking or flagging lateral connection attempts that fall outside of defined, policy-permitted communication paths, reducing the number of systems the backdoor could realistically reach after initial enumeration.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility across the fabric would likely surface anomalous outbound connection patterns — such as workloads contacting typosquatted domains or unusual GitHub API endpoints — that fall outside of expected traffic baselines, giving operators a meaningful opportunity to identify and respond to active C2 channels before operators can complete their tasking.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN-aware egress policy enforcement would likely constrain the attacker's ability to reliably deliver exfiltrated data to file-sharing services like file.io and gofile.io by restricting outbound connections to destinations that fall outside of explicitly permitted egress allowlists, reducing how much collected data can actually leave the environment through these channels.
Had segmentation, east-west controls, and egress enforcement been applied across prior stages, the attacker's persistent access would likely have been constrained to a reduced set of reachable workloads, with exfiltration pipelines disrupted and C2 channels limited — reducing the volume and continuity of sensitive data collected across the multi-year campaign even if initial compromise was not prevented.
Impact at a Glance
Affected Business Functions
- Government Intelligence and Diplomatic Communications
- Corporate Network Integrity and IT Operations
- Sensitive Data Repositories and Internal File Stores
- User Endpoint Security and Identity Management
Estimated downtime: N/A
Estimated loss: N/A
The Bronze Sandcastle backdoor is designed for long-term covert espionage. Confirmed data collection capabilities include keylogging (capturing credentials, communications, and sensitive typed content), screenshot capture (exposing sensitive on-screen information such as classified documents or proprietary business data), enumeration of local network topology and user accounts (enabling lateral movement planning), system metadata harvesting (OS version, hardware fingerprints, domain memberships), and running process lists (revealing installed security tools and enterprise software). Victims span government-adjacent and strategic sectors across the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea, indicating high-value geopolitical intelligence targeting. Encrypted payloads communicated with external file-sharing services (file.io, gofile.io, ably.net) and actor-controlled GitHub repositories, suggesting exfiltration of collected data. The persistent, low-noise nature of the implant means dwell time may extend months to years, amplifying the volume of exposed sensitive material.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement (FQDN filtering): Bronze Sandcastle relied on outbound C2 to file-sharing services (file.io, gofile.io, ably.net) and typosquatted domains. Enforcing strict egress FQDN allowlisting and outbound policy via CNSF Egress Security would have blocked or alerted on unauthorized destination traffic, directly disrupting C2 and exfiltration channels aligned with ZTMM.Data and NIST.800-53.SC-18.
- • Enable Multicloud Visibility & Control with anomaly baselining: The use of GitHub API for C2 (T1102.002) and legitimate cloud file-sharing for exfiltration (T1567.002) would be detectable through centralized traffic observability and behavioral anomaly detection. CNSF Multicloud Visibility tools monitoring for anomalous cloud-service egress patterns and repeated unusual API calls would surface this activity early, aligned with ZTMM.CrossCutting.Visibility and NIST.800-53.AU-6.
- • Apply Zero Trust Segmentation to restrict east-west reconnaissance: The backdoor's network enumeration and user account discovery phase depends on broad internal network visibility. Enforcing microsegmentation and identity-based workload policies via CNSF Zero Trust Segmentation and East-West Traffic Security would limit blast radius and prevent lateral movement between segments, aligned with ZTMM.Network and NIST.800-53.AC-6.
- • Activate Inline IPS (Suricata) for encrypted payload delivery and known sideloading patterns: While the payloads are encrypted at rest, network-level signatures for known Bronze Sandcastle C2 domains, DLL sideloading staging behaviors, and malicious payload delivery patterns can be detected inline. CNSF Inline IPS provides signature-based blocking of exploit traffic and malicious payload delivery, aligned with NIST.800-53.SI-4 and PCI.4.0.6.4.1, and should be updated with threat intelligence on Bronze Sandcastle IOCs.
- • Leverage Cloud Firewall (ACF) for internet egress control with AI traffic discovery: Because Bronze Sandcastle blends C2 and exfiltration into legitimate-looking HTTPS traffic to cloud services, CNSF Cloud Firewall with AI-assisted discovery of abnormal egress traffic patterns and URL filtering provides a critical last-mile control to detect and block unauthorized outbound communications before data leaves the environment, aligned with ZTMM.Network, NIST.800-53.SC-7, and NIST.CSF.DE.CM-8.
