Security · Updated 21 Oct, 05:35 pm IST
China-aligned 'Bronze Sandcastle' uses Sandboxie DLL sideloading to install backdoors
Why it matters for readers: If you follow cybersecurity, it shows a new named threat actor and a specific technique (Sandboxie DLL sideloading) to watch for.
- A new, previously undocumented China-aligned threat cluster has been named Bronze Sandcastle.1
- Bronze Sandcastle has been observed targeting organizations in Asia and Africa since mid-2025.1
- The group consistently uses Sandboxie DLL sideloading as its primary technical marker to deploy backdoors.1
- The disclosure and technical details were published by a Sophos researcher, Gabor Szappanos.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started