China-Aligned Bronze Sandcastle Exploits Sandboxie DLL Sideloading for Backdoor Deployment

Cybersecurity researchers identified the China-aligned Bronze Sandcastle threat group, which has been targeting organizations in Asia and Africa since mid-2025 using Sandboxie DLL sideloading to deploy backdoors. The technique involves exploiting trusted software components to bypass security measures.

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025.

"The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published

Read original article