Bronze Sandcastle Is Hiding Backdoors in a Sandbox Tool You Trust

Emily Davis · 2026-10-21

Cybersecurity researchers just pulled back the curtain on a threat group they're calling Bronze Sandcastle, and the way it sneaks into networks is genuinely clever. According to Sophos researcher Gabor Szappanos, this is a previously undocumented, China-aligned cluster that's been quietly targeting organizations across Asia and Africa since mid-2025. The headline finding? Bronze Sandcastle leans hard on **Sandboxie DLL sideloading** to plant backdoors. If that phrase sounds technical, don't worry. The idea behind it is something you can grasp in a couple of minutes, and it's worth understanding because it changes how you think about trust. ### What DLL sideloading actually means Picture a trusted program that loads a helper file every time it starts up. That helper file is a DLL, a little library of code the program depends on. Now imagine an attacker drops their own malicious version of that helper right next to the program. The app runs, grabs the fake helper, and executes whatever the attacker stuffed inside it. That's sideloading in a nutshell. The program itself is legitimate. The signature checks out. Nothing looks broken. And that's exactly why it works so well. ### Why Sandboxie is the perfect disguise Sandboxie is a well-known tool for running programs in an isolated environment, and it's used by plenty of security pros and developers. By hijacking its DLL loading behavior, Bronze Sandcastle gets to hide malicious code inside a process people already trust. As Szappanos put it: > "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading." That consistency matters. It's not random opportunism. It's a repeatable playbook, which tells defenders exactly what to watch for. ### What this means for you You don't need to be a nation-state target to care about this. The takeaway is broader: - **Trusted software isn't automatically safe.** Legitimate apps can become delivery vehicles if their files get tampered with. - **File integrity checks matter.** Verify the files sitting next to your executables haven't been swapped. - **Watch for unusual process behavior.** A familiar program doing unfamiliar things deserves a second look. - **Keep your isolation tools updated.** Anything that runs code in a sandbox should be patched and monitored. ### The bigger picture Supply chain tricks like this keep showing up because they work. Attackers don't need to break down the front door when they can pose as someone you already let inside. Bronze Sandcastle is a reminder that the most dangerous intrusions often wear a familiar face. If you run security for an organization, this is a good moment to review how your endpoint tools handle DLL loading and whether you're validating the files that live beside your trusted applications. A little paranoia goes a long way. Stay sharp out there. The threats are getting quieter, not louder.