Cybersecurity researchers have uncovered a new method employed by hackers linked to China, involving the use of legitimate Windows applications to deploy backdoors and steal sensitive user credentials. The group, identified as BRONZE SANDCASTLE, has been exploiting trusted software to execute malicious code without altering the original applications.
Exploiting Trusted Software
The method involves placing harmful files alongside genuine software, which allows attackers to run their own code under the guise of familiar program operations. Such techniques illustrate the potential for legitimate applications to be harnessed in malicious attack sequences, despite shared methodologies not conclusively linking various threat groups.
Researchers from Sophos’ Counter Threat Unit and SophosLabs unearthed this malware during investigations across Asia and Africa. Their findings, detailed in a report published on October 20, chronicle attacks observed from August 2025 to August 2026, affecting countries including the Philippines, Taiwan, Afghanistan, Namibia, and potentially South Korea.
Technical Markers and Techniques
Noteworthy among the technical markers is the use of Sandboxie DLL sideloading, where attackers pair legitimate Sandboxie programs with malicious libraries. Upon execution, the trusted application loads the library, handing control over to the attackers. The report also highlights similar abuses involving components from Java, Krita, NVDA, LINE, and Microsoft Sysinternals.
The malicious libraries are designed to read encrypted payloads from local configuration files, decode them, and execute the code in memory. This approach separates the visible application from the malicious backdoor, allowing operators to modify payload behavior without altering the loading library. Renaming executables further assists in camouflaging the files within compromised systems.
Payloads and System Compromise
The backdoor utilizes a sophisticated reflective loader to implant an embedded Windows program into memory. Despite similarities to Metasploit shellcode, the presence of custom function-resolution routines and a more intricate codebase indicates advanced customization. Versions 1.1.5 and 1.1.7 of the payload were identified, with the former connecting to dedicated control domains and the latter retrieving encrypted configurations via GitHub.
Post-compromise, attackers employed Windows network commands to examine accounts and networks, creating Volume Shadow Copies before copying the Active Directory database. This sequence of actions aligns with efforts to extract sensitive domain credentials, underscoring the significance of these tactics.
To combat such threats, Sophos recommends vigilance in detecting libraries that execute code in memory and unusual executable headers, alongside behavior and memory monitoring. Static file detection may be less effective against encrypted payloads.
Indicators of compromise include specific domains and services linked to the malware’s operations, with Sophos highlighting the importance of updating defenses against emerging threats and integrating threat intelligence feeds from various SOCs.
