Bronze Sandcastle: the DLL sideloading your SME should watch out for

A new name on the persistent threat map

Sophos researchers have given a name to a threat cluster that had so far gone unnoticed: Bronze Sandcastle, a China-aligned group that, according to the analysis published by researcher Gabor Szappanos, has been attacking organizations in Asia and Africa since mid-2025. What makes it unique is not the volume or the arsenal, but a very specific technique: the systematic use of DLL sideloading taking advantage of Sandboxie, the well-known application isolation utility.

For those unfamiliar with the term, DLL sideloading consists of placing a malicious library with the exact name of a legitimate DLL in the same folder as a trusted executable. When that executable starts, it loads the fake version instead of the good one, and the attacker gains code execution without the need for exploits or elevated permissions. It is an old technique, but it still works because it relies on something very difficult to eradicate: the trust we place in the binaries we already know.

Why Sandboxie and not something else

Sandboxie is a legitimate tool, with years of history and a user base that installs it precisely to isolate processes and reduce risks. That is the detail that makes Bronze Sandcastle an interesting case: the group has not invented a new vector, it has chosen software that many companies already have or could have installed without raising suspicion. If a Sandboxie executable loads a tampered DLL from its own directory, the result is a backdoor that, in the eyes of a basic antivirus, may look like part of the application's normal operation.

The Sophos report identifies this technique as the most distinctive technical hallmark of the cluster, which suggests a stable modus operandi repeated over time. This is not an opportunistic attack that changes tools every week, but an actor that has found a method that works for it and exploits it consistently.

What this means for an SME

The instinctive reaction of many IT managers at an SME is to think that a China-aligned group is not going to waste its time on them. This is a frequent miscalculation. Persistent threat actors do not choose targets by size, but by accessibility and usefulness. An SME with a connected supplier, with an exposed ERP or with an employee who downloads utilities from forums can be the first stone in a chain that later reaches higher up. And in the case of DLL sideloading, the entry cost for the attacker is low: it is enough to trick someone into running a file or to compromise an installer.

There is a second reason to take it seriously: the technique itself does not require administrator privileges. That means a standard user, with an account without elevated permissions, can be the entry vector. If your security policy relies only on "users are not administrators", this case shows that this measure, while necessary, is not enough.

Concrete recommendations

1. Inventory of isolation software and utilities. Check whether Sandboxie or other similar tools are installed on your machines. If there is no clear business justification, uninstall them. Every trusted binary in a writable directory is an opportunity for sideloading.
2. Control what runs from user folders. Application policies (AppLocker, WDAC or equivalents) that prevent launching executables from Downloads, Desktop or temporary folders cut off a good part of these attacks at the root.
3. Verify the integrity of critical DLLs. File integrity monitoring tools and code signing help detect when a legitimate DLL has been replaced by another with the same name.
4. Do not rely on antivirus alone. Sideloading is designed to look legitimate. Complement it with EDR or, if the budget does not stretch, with behavior-based detection rules and periodic review of processes that load DLLs from unusual paths.
5. Train the team on the supply chain. A good part of these attacks start with an installer or a fake update. An employee who knows how to distinguish a signed binary from one that is not is worth more than any tool.

The broader context: the technique travels

Bronze Sandcastle is a reminder that the techniques of state groups end up leaking into the general criminal ecosystem. What we see today in a China-aligned cluster will tomorrow appear in a low-cost phishing kit. That is why it is worth reading this type of report not as an alert about a distant enemy, but as a preview of what may reach your network within months.

At ForgeNEX we have insisted on other occasions that the security of an SME is decided in operational details, not in big promises. Cases such as APT28 and the Swallowtail case or espionage in the office show the same pattern: sophisticated actors that take advantage of careless configurations and everyday tools. Defense does not consist of buying the most expensive product, but of closing the doors you already have open.

A note on the scope of the report

It is worth being cautious about what the report does not say. Sophos describes the cluster, its distinctive technique and the affected regions, but does not detail in the available excerpt the number of victims or the specific sectors. Any figure you see circulating out there that is not in the original report should be treated with skepticism. In security, speculation does more harm than ignorance: it leads to investing in what does not matter and neglecting what does.

What we can affirm is that DLL sideloading remains a profitable technique for the attacker and cheap to mitigate for the defender. Reviewing the software inventory, restricting execution from user paths and monitoring library loading are measures that any SME can start applying this very week, without large budgets and without waiting for the incident to occur.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.