Threat actors affiliated with China have been exploiting well-known Windows applications to deploy concealed backdoors aimed at harvesting system information and stealing Active Directory credentials. The group, known as BRONZE SANDCASTLE, manages this by placing malicious libraries or DLLs alongside legitimate programs—allowing those programs to execute attacker-controlled code without replacing the original executable.
What the Attack Chain Looks Like
According to a detailed Sophos report, attacks observed between August 2025 and August 2026 across Asia and Africa—countries including the Philippines, Taiwan, Afghanistan, Namibia, and believed to involve South Korea—employed DLL sideloading techniques. BRONZE SANDCASTLE has abused legitimate software like Sandboxie, Java, Krita, NVDA, LINE, and tools from Microsoft Sysinternals to load malicious supporting libraries during runtime. These libraries read encrypted payloads from configuration files, decode them, then execute the payload in memory—creating a stealthy backdoor split across multiple components.
The group has included versioned payloads—1.1.5 and 1.1.7—in its toolkit. The former contacts dedicated control domains directly, while the latter retrieves encrypted configuration files via GitHub. These payloads gather extensive system detail—user and computer names, domain information, OS version, IP addresses, process listings, working directory, processor type and startup time—and transmit this data back to their operators.
How They Escalate and What They Target
Once inside, attackers use Windows networking tools to inspect accounts and networks. They also create Volume Shadow Copies to extract the Active Directory database, using these snapshots to expose otherwise protected data. This sequence of actions—system reconnaissance followed by evidence collection—underscores the threat’s sophistication.
Sophos recommends that defenders monitor for libraries that load encrypted configuration files and immediately execute code in memory. Particular attention should be paid to reflective loading—or methods that bypass regular execution flows—along with anomalies in executable headers. Static file detection is frequently evaded by encryption and other obfuscation, so behavior- and memory-based detection is essential.
Indicators of compromise include control domains like dc.cathaypacifice.com and net.dpworldto.com; connections to services such as file.io, gofile.io, and GitHub; and specific DLL pairs used in sideloading scenarios. We’ve also seen suspicious versions of executables bundled with sidecar DLLs, such as SandboxieWUAU.exe paired with sbiedll.dll, or Krita.exe with Krita.dll.
This campaign echoes earlier attacks that abused DLL sideloading and ShadowPad-style infrastructures. While there are technical similarities, this group has been tracked separately due to distinct behaviors and unambiguous separations from related threat clusters.
At its core, this attack demonstrates the rising sophistication of supply-chain-adjacent threats: by hiding in trusted tools, attackers minimize upfront detection and blend into the software environment. Active Directory databases, in particular, are high-value targets, offering keys to large networks.
What this means & what to watch: Organizations need to reassess trust boundaries. Trusted applications are no longer safe by default—sidecar DLLs, reflective loaders, and encrypted payloads are now primary vectors for breaching networks. Defense strategies must shift toward dynamic behavior monitoring, strong visibility into what libraries software is loading, and constant vigilance around identity and credential systems. For all defenders, this is a wake-up call: attackers are increasingly turning legitimate tools into weapons.
