China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Researchers have identified a previously unknown China-aligned threat group called Bronze Sandcastle, which has been targeting organizations in Asia and Africa since mid-2025. The group's most notable technical characteristic is its use of Sandboxie DLL sideloading. This technique is used by Bronze Sandcastle to deploy backdoors. According to Sophos security researcher Gabor Szappanos, the consistent use of this method is a distinctive marker for the group. Bronze Sandcastle's activities have been observed by cybersecurity researchers, who have now disclosed details about the threat cluster. The group's use of DLL sideloading allows it to abuse legitimate software for malicious purposes.