Skip to content
BRONZE SANDCASTLE Exploits Sandboxie for Encrypted Backdoor Attacks

BRONZE SANDCASTLE Exploits Sandboxie for Encrypted Backdoor Attacks

First seen 21 Oct 2026, 11:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 12:16 UTC
  • •BRONZE SANDCASTLE uses DLL sideloading with legitimate apps to deploy malware.
  • •Victims include organizations in Asia and Africa, with notable targets in the Philippines and Namibia.
  • •The backdoor can collect sensitive system information and steal Active Directory data.

The BRONZE SANDCASTLE hacking group has been identified using legitimate Windows applications, including Sandboxie, to deploy encrypted backdoors on systems in Asia and Africa. Sophos researchers tracked this activity from August 2025 to August 2026, affecting organizations in the Philippines, Taiwan, Afghanistan, and Namibia, with potential victims in South Korea. The group employs DLL sideloading techniques, placing malicious DLLs alongside legitimate executables to execute payloads stored in encrypted config.ini files. This method allows the attackers to update the backdoor's behavior without changing the DLL, minimizing detection risks. The backdoor, based on a modified Meterpreter, collects system information and can steal Active Directory data. Sophos noted that while other groups target similar regions, BRONZE SANDCASTLE's unique use of Sandboxie sideloading helps differentiate their operations. Organizations are advised to monitor for unexpected library loads and encrypted files in memory.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-08-01
BRONZE SANDCASTLE activity tracked
Sophos began monitoring the group's operations, identifying victims across multiple countries.
Hackread
2026-10-20
Sophos publishes research on BRONZE SANDCASTLE
Sophos detailed the group's use of DLL sideloading and the technical aspects of their malware.
Sophos
2026-10-21
Hackread reports on BRONZE SANDCASTLE
Hackread published findings on the group's attacks and their impact on organizations in Asia and Africa.
Hackread

More articles in this cluster (6)

Following this threat?

Track Bronze Atlas in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (23)

1 / 4

Common questions

What applications are being exploited?
Legitimate applications like Sandboxie, Java, Krita, NVDA, and Sysinternals utilities are being exploited.
How can we detect this threat?
Organizations should monitor for unexpected library loads and encrypted files executed in memory.
What is the nature of the backdoor?
The backdoor is a modified Meterpreter that collects system information and can facilitate credential theft.