The Silent Shadow: Unmasking the BRONZE SANDCASTLE Threat Actor

In the ever-evolving landscape of global cyber espionage, the Counter Threat Unit™ (CTU) and SophosLabs have identified a sophisticated, China-linked threat actor dubbed "BRONZE SANDCASTLE." This group, characterized by its highly methodical approach to stealth and its reliance on advanced DLL sideloading techniques, has spent the last year conducting precision strikes against organizations across Asia and Africa. By weaponizing trusted software and utilizing in-memory execution to evade traditional defenses, BRONZE SANDCASTLE represents a modern evolution in the art of clandestine data exfiltration.

Main Facts: The Anatomy of a Stealthy Operator

The hallmark of BRONZE SANDCASTLE’s operations is its technical elegance. Rather than relying on custom, noisy malware that often triggers endpoint detection and response (EDR) alerts, the group leverages "living-off-the-land" (LotL) tactics. Their most distinctive marker is the consistent use of DLL sideloading—a technique where a legitimate, trusted executable is manipulated into loading a malicious library.

In multiple observed environments, the attackers placed legitimate Sandboxie executables alongside a malicious sbiedll.dll. When the trusted application launches, it unknowingly executes the malicious code. This pattern is not limited to Sandboxie; the group has demonstrated significant versatility, utilizing a wide array of legitimate software to facilitate their intrusion, including Java (javaw.exe), Krita (Krita.exe), and various Sysinternals utilities.

By renaming these legitimate executables to blend into the target’s environment, the threat actors ensure that their presence remains indistinguishable from standard administrative or operational tasks. The execution results in in-memory shellcode activity, leaving behind no traditional disk-based artifacts that might alert forensic investigators to an ongoing breach.

Chronology of Intrusion: From Infiltration to Exfiltration

Analysis of incidents occurring between August 2025 and August 2026 reveals a clear, repeatable lifecycle for BRONZE SANDCASTLE’s campaigns.

The Staging Phase

The operation typically begins with the deployment of a ZIP archive, such as aez.zip, within the target system. This archive contains three primary components: the clean loader (e.g., javaw.exe), the sideloaded malicious DLL (e.g., jli.dll), and an encrypted config.ini file. This modular design is intentional; it allows operators to update their malicious payloads or alter behavioral characteristics without ever needing to replace the underlying DLL binary, thereby bypassing many static file-based detection signatures.

The Execution Phase

Once the loader initiates, the DLL decrypts the config.ini file. To thwart reverse engineering, the malicious code implements a flattened control-flow dispatcher. Instead of using direct, readable branches, the code utilizes a virtualized state machine. A custom bit-mixing routine—involving byte swapping, variable rotations, and inversion—transforms the program’s logic into a complex web of indirect jumps. Some paths even lead to "fall-through" locations, intentionally designed to misdirect security researchers and complicate static analysis.

The Post-Exploitation Phase

Once the payload is successfully injected and decoded in memory, it reveals itself as a highly capable backdoor. The payload is a position-independent reflective loader, showing structural similarities to Metasploit, yet significantly more complex. It employs non-standard API hashing routines, indicating a bespoke development process. During this phase, the attackers conduct reconnaissance, using native Windows commands like net to map the local network and user accounts. Perhaps most concerning is their use of vssadmin.exe to create Volume Shadow copies, a necessary step for the exfiltration of the ntds.dit file—the central Active Directory database containing domain-wide credentials.

Supporting Data: Infrastructure and Global Reach

The geographic distribution of BRONZE SANDCASTLE’s victims highlights a strategic focus on emerging markets and geopolitical hotspots. Between August 2025 and August 2026, researchers confirmed activity in the Philippines, Taiwan, Afghanistan, Namibia, and the Republic of Korea.

Technical Indicators and C2 Architecture

The command-and-control (C2) architecture utilized by the group is as evasive as their execution methods. Payloads have been observed reaching out to legitimate third-party services—including file.io, gofile.io, and ably.net—to receive tasking, effectively masking their communication within the noise of standard web traffic.

In a brazen display of operational convenience, newer versions of the payload (1.1.7) have been observed interacting directly with GitHub repositories to download encrypted configuration files. A repository identified as LatonyCharnleyaW contained various files disguised as JavaScript source maps and TypeScript files, serving as the delivery mechanism for the group’s implants.

Time-Based Attribution

The "smoking gun" for the group’s origin lies in the analysis of their operational hours. A heatmap of activity shows a strong concentration in the UTC+8 time zone, with peaks that align perfectly with the "996" working hour system—a grueling schedule common in China’s technology sector (9:00 AM to 9:00 PM, 6 days a week). This temporal fingerprint, combined with their regional targeting, strongly suggests that BRONZE SANDCASTLE is a state-aligned actor operating out of China.

Official Responses and Strategic Implications

The discovery of BRONZE SANDCASTLE underscores the limitations of signature-based defense models. Because the group utilizes trusted, signed binaries to launch their attacks, traditional antivirus programs often fail to flag the initial entry point.

The Shift in Defense

Security organizations, particularly those in the government, telecommunications, and critical infrastructure sectors, are being urged to move toward a "behavioral detection" posture. CTU researchers emphasize that the most effective way to detect this actor is to monitor for the specific behavior of legitimate DLLs reading local configuration files followed by immediate, anomalous in-memory execution.

"Static detection is no longer sufficient," says a lead analyst at SophosLabs. "We are seeing a trend where attackers use the victim’s own tools against them. Organizations must prioritize memory-based detection and look for the signatures of reflective loading, such as anomalous PE headers residing in memory where they do not belong."

The Strategic Threat

The targeting of Active Directory databases indicates that BRONZE SANDCASTLE is not merely interested in temporary access; they are looking for persistent, "God-mode" access to the entire enterprise domain. By stealing credentials and domain configurations, the group gains the ability to move laterally, maintain long-term persistence, and conduct large-scale intellectual property theft or strategic intelligence gathering without ever needing to re-infect the environment.

Recommendations for Hardening Defenses

To defend against the sophisticated methods employed by BRONZE SANDCASTLE, security teams should implement the following hardening measures:

1. Monitor for DLL Sideloading: Utilize EDR solutions to create alerts for instances where known, legitimate executables (like javaw.exe or Sandboxie.exe) are launched from non-standard directories or attempt to load DLLs from their own local folder rather than the system-protected System32 directory.
2. Memory Inspection: Enable memory scanning to identify reflective loaders. Tools that can detect "floating" PE headers—executable headers that do not correspond to a file on disk—are essential for identifying this group’s backdoor.
3. Restrict Administrative Commands: Audit the use of vssadmin.exe and net commands. Access to these utilities should be restricted to service accounts or known administrative workstations; unauthorized usage by standard user processes should trigger an immediate investigation.
4. Network Egress Filtering: Restrict internal systems from reaching out to file-sharing sites and public repositories like GitHub unless there is a verified business requirement. All egress traffic should be inspected through a robust proxy or firewall to identify anomalous JSON data blocks characteristic of the group’s C2 communication.
5. Active Directory Protection: Treat the ntds.dit file as a high-value asset. Implement strict monitoring on Volume Shadow copy creation and ensure that domain controllers are isolated from standard user segments.

As BRONZE SANDCASTLE continues to refine its techniques, the security community must remain vigilant. This group is a prime example of why modern cybersecurity requires a proactive, hunt-based approach rather than a reactive, patch-based strategy. By understanding the group’s reliance on trust-abuse and memory-based execution, organizations can move from a position of vulnerability to one of resilience. For a comprehensive list of Indicators of Compromise (IoCs) associated with this campaign, security teams are encouraged to consult the official SophosLabs GitHub repository.