Sophos Ties China-Aligned Bronze Sandcastle to Sandboxie DLL Sideloading

Past-week coverage · Original source published 2026-10-21.

Sophos researchers have published details of a previously undocumented threat cluster they call Bronze Sandcastle, which they describe as China-aligned and say has been observed targeting organizations in Asia and Africa since mid-2025.

In a post attributed to Sophos security researcher Gabor Szappanos, the researchers said the group's "most distinctive technical marker" is its consistent use of Sandboxie DLL sideloading to deploy backdoors. DLL sideloading is a technique in which an attacker places a malicious library where a legitimate, trusted application will load it instead of the real one, so the malicious code runs under the trusted program's name.

The report, as summarized in the retained coverage, does not detail the specific backdoors involved, the number of victims, or which sectors were hit. It also does not describe how initial access was gained or whether any activity is ongoing.

Why it matters

Naming a cluster and tying it to a repeatable loader technique gives defenders something concrete to hunt for. Sideloading abuse tends to leave traces in file paths and library names rather than in exploits, so detection often depends on knowing which legitimate applications are being imitated.

What defenders can do

• Review endpoint telemetry for legitimate applications loading libraries from unexpected directories.
• Treat unusual library loads by signed, trusted binaries as worth investigating, not dismissing.
• Compare findings against the indicators in the Sophos research, which the retained coverage does not reproduce.

The attribution to China is the researchers' assessment, not a confirmed finding by a government body.