Hunt for Sandboxie DLL Sideloading to Stop AD Theft by BRONZE SANDCASTLE
Threat actors use trusted Windows apps to load malicious libraries, stealing directory data from targets across Asia and Africa between 2025 and 2026.
Key points
- BRONZE SANDCASTLE actors abused Sandboxie and other legitimate software to execute encrypted payloads via DLL sideloading.
- Investigations from August 2025 to August 2026 linked the group to victims in the Philippines, Taiwan, Afghanistan, Namibia, and South Korea.
- The malware uses complex obfuscation techniques to hide from conventional scanning and steal Active Directory databases.
BRONZE SANDCASTLE operators have compromised multiple organizations by injecting malicious code into trusted Windows processes, according to a report by GBHackers. The suspected China-based group utilizes a combination of legitimate applications, malicious dynamic link libraries, and encrypted payloads to execute commands while minimizing detectable artifacts. This approach allows the threat actors to operate within trusted environments, making detection by standard file-scanning tools significantly more difficult for security teams monitoring endpoint activity.
The risk
The primary technical signature of this campaign is the repeated abuse of Sandboxie executables to load attacker-controlled sbiedll.dll files. Operators place both the legitimate application and the malicious library in the same directory, enabling the trusted program to execute malicious code through DLL sideloading, a technique tracked by MITRE under identifier T1574.001. This method conceals the execution of encrypted payloads within processes that security software typically trusts, bypassing conventional integrity checks and allowing the malware to persist with a low profile on infected systems.
Who is exposed
Investigations covering the period from August 2025 through August 2026 identified victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea, according to GBHackers. Researchers assigned this activity a separate designation because its distinctive tooling could not be reliably attributed to other established threat groups. The group’s targets appear to span multiple regions, suggesting a broad operational scope rather than a narrow focus on a single industry or geographic sector during the observed timeframe.
Cost and compliance
The source material does not specify financial losses, regulatory penalties, or specific compliance failures resulting from these intrusions. GBHackers reports that the group successfully stole Active Directory databases from compromised environments. No details regarding legal action, insurance claims, or mandatory disclosure timelines are provided in the available reporting. The focus of the analysis remains on the technical methods used for access and data exfiltration rather than the downstream organizational or legal consequences for the affected entities.
Our take on the response
Security teams should prioritize validating the integrity of directories containing legitimate administrative tools. Because the attackers rely on placing malicious DLLs alongside trusted executables, ensuring strict access controls and file integrity monitoring on these folders is essential. Detecting the presence of unexpected libraries in application directories can reveal early-stage compromises before data theft occurs.
What defenders should look for
Teams usually monitor for legitimate applications loading unexpected dynamic link libraries from non-system directories. Check whether trusted executables are initiating network connections from directories that do not match their installation paths. Look for encrypted configuration files appearing alongside known software, which may indicate a reflective loader preparing to execute. Investigate processes that exhibit flattened control flow or unusual memory allocation patterns, as these behaviors often signal custom obfuscation techniques used to evade static analysis and hide malicious activity from endpoint detection systems.
Background: DLL sideloading
DLL sideloading occurs when an attacker places a malicious file with the same name as a required system library in the same folder as a legitimate executable. The application loads the attacker’s file first, granting the malware the trust and privileges of the original program.
Read the full guide: What Is DLL Sideloading: How Attackers Hijack Legitimate Software
What to do and how to stay safe: BRONZE SANDCASTLE
- Audit directories containing legitimate software for unexpected DLL files that do not match the vendor's official distribution.
- Monitor for execution of known administrative tools from paths that are not their standard installation locations.
- Review process injection events and DLL loading logs for anomalies involving trusted applications.
- Isolate systems showing signs of unexplained encrypted file creation or memory-resident execution once the vendor provides an update.
Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What software did BRONZE SANDCASTLE abuse to hide their malware?
The group abused Sandboxie, Java, Krita, NVDA, LINE, and Microsoft Sysinternals utilities to execute malicious code.
How do the attackers conceal their payloads from scanning tools?
They use DLL sideloading and encrypted payloads with complex obfuscation, including flattened control flow and byte swapping.
Which regions were affected by these intrusions between 2025 and 2026?
Victims were identified in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea.
