Our takeSophos details a previously undocumented China-aligned group, Bronze Sandcastle, that uses Sandboxie DLL sideloading to run modified Meterpreter shells and steal data from targets in Asia and Africa. Patch your systems and monitor for sideloaded DLLs.Security Resilience desk
Sources (3)
- sophos_xops · sophos_xops
- hackread · hackread
- hackernews · hackernews
What this means for you — Security leader:Review endpoint telemetry for Sandboxie.exe or SbieDll.dll sideloading and anomalous Meterpreter-like C2; block unsigned or unexpected DLL loads in those paths.
What this means for you — Lean IT orgs:If you run Windows desktops or servers, make sure only trusted software is installed and avoid running random tools from the internet; watch for unusual slowdowns or network traffic.
What this means for you — MSP:Scan client environments for Sandboxie DLL sideloading and modified Meterpreter artifacts; add detection rules for the specific loader patterns Sophos described.
What this means for you — Researcher:Track BRONZE SANDCASTLE's consistent Sandboxie sideloading TTP and the modified Meterpreter variants; correlate with other China-aligned clusters using similar DLL techniques.