Back Broadcom

BRONZE SANDCASTLE Uses DLL Sideloading to Deploy Custom Meterpreter

Broadcom • October 21, 2026

Researchers at the Sophos Counter Threat Unit recently reported on BRONZE SANDCASTLE, a China-based threat cluster active against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Research details how the group pairs legitimate signed executables, such as Sandboxie binaries, with a malicious DLL to sideload and decrypt an encrypted configuration payload directly in memory. The resulting backdoor is a stageless implant that resembles Meterpreter. Following successful staging, operators conduct local network enumeration and attempt Active Directory credential theft from newly created Volume Shadow Copies.

Symantec protects you from this threat, identified by the following:

Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

Machine Learning-based

Observed domains/IPs are covered under security categories in all WebPulse enabled products

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BRONZE SANDCASTLE Exploits DLL Sideloading for Cyber Attacks The BRONZE SANDCASTLE threat group, aligned with China, has been targeting organizations in Asia and Africa since mid-2025 using DLL sideloading techniques. This group employs modified Meterpreter shells, utilizing legitimate applications like Sandboxie to load malicious DLLs, notably 'sbiedll.dll'. The attacks have affected entities in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea, with a notable focus on the UTC+8 time zone. The malicious payloads are stored in encrypted config.ini files, allowing for stealthy execution and evasion of detection. The group has been observed using various combinations of DLL sideloading, enhancing their ability to infiltrate systems without triggering alarms. Current reports indicate that the group remains active and continues to refine their tactics. 4 sources 73

Extracted Entities

BRONZE SANDCASTLE Uses DLL Sideloading to Deploy Custom Meterpreter

The full story

Extracted Entities

Attack Types (1)

Countries (5)

MITRE ATT&CK (3)

Platforms (1)

Tools (1)