China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Researchers at Sophos disclosed a China-aligned threat cluster named Bronze Sandcastle, active since mid-2025, targeting organizations in Asia and Africa. The group uses Sandboxie DLL sideloading to deploy backdoors, a distinctive technical marker. Sophos researcher Gabor Szappanos detailed the findings in a post, highlighting the group's consistent attack method.