Cybersecurity researchers have recently unveiled a China-aligned threat group known as Bronze Sandcastle, which has been actively targeting organizations across Asia and Africa since mid-2025. This group is primarily recognized for its use of a technique called DLL sideloading, leveraging it to deploy malware within compromised systems.
Understanding DLL Sideloading
DLL sideloading is an adversarial method that exploits how Windows operating systems load DLL files. Attackers trick legitimate programs into loading malicious DLLs by placing them where the system searches first. This allows unauthorized code execution without immediate detection.
When applications require DLLs to run, the lack of a specified path prompts the OS to search through a sequence of directories. Attackers exploit this by placing a malicious DLL with the same name as a legitimate one in a directory scanned before the genuine file’s location. Consequently, the application inadvertently loads the harmful DLL, granting attackers access to the system.
Bronze Sandcastle’s Targeted Operations
From August 2025 to August 2026, Bronze Sandcastle has attacked entities in countries such as the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. The group’s activities predominantly align with the UTC+8 time zone, suggesting a base of operations in that region.
The threat actor utilizes legitimate applications like Sandboxie to disguise their malicious activities. For example, the trusted Sandboxie executable, combined with a malicious “sbiedll.dll,” permits attackers to insert code into the application runtime, often bypassing antivirus detection.
Techniques and Persistence
Besides Sandboxie, Bronze Sandcastle employs at least seven other DLL sideloading combinations, including applications like Java, Krita, and NVDA. These sideloaded DLLs execute payloads stored in encrypted configuration files, minimizing static detection and enabling dynamic behavior modification.
The malicious payloads serve as backdoors, collecting system metadata and user information. They communicate with external sites for command-and-control purposes, furthering the attacker’s reach and adaptability.
In previous incidents, similar methods have been utilized by other Chinese hacking groups, underscoring the persistent threat posed by such techniques.
Future Outlook and Recommendations
The ongoing use of DLL sideloading by threat actors like Bronze Sandcastle highlights the need for enhanced cybersecurity measures. Organizations should focus on identifying behavioral indicators of malicious activity, such as unusual DLL loading patterns, to safeguard against these sophisticated attacks.
Adopting a proactive approach, including real-time monitoring and behavioral analysis, can help detect and mitigate threats before they cause significant damage. As threat groups evolve, staying informed and prepared is crucial for maintaining cybersecurity resilience.
