Actor Profile

Bronze Sandcastle is a China-aligned threat actor cluster disclosed by Sophos in October 2026. Active since mid-2025, the group conducts cyber espionage operations targeting organizations in Asia and Africa. Evidence indicates the actor operates primarily in the UTC+8 time zone, consistent with China-based operations. Bronze Sandcastle is characterized by its consistent use of Sandboxie DLL sideloading as a primary initial access and persistence technique, distinguishing it from other Chinese APT groups.

TTPs (Tactics, Techniques, Procedures)

Bronze Sandcastle employs DLL sideloading (T1574.002) as its signature technique, abusing legitimate signed applications including Sandboxie executables (SandboxieWUAU.exe), Java (javaw.exe), Krita, NVDA, and Sysinternals tools (vmmap.exe, bginfo64.exe) to load malicious DLLs. The actor uses encrypted configuration files (config.ini) for payload delivery (T1027 - Obfuscated Files or Information), minimizing static detection. Post-compromise activities include system and network discovery (T1082, T1016), credential enumeration (T1087), process discovery (T1057), keylogging (T1056.001), and screen capture (T1113). Command-and-control leverages legitimate file-sharing services (file.io, gofile.io, ably.net) and GitHub repositories for encrypted configuration retrieval (T1102 - Web Service). The group achieves persistence through auto-start applications loading malicious DLLs (T1547), and executes payloads in-memory to avoid disk artifacts (T1620 - Reflective Code Loading).

Targets & Patterns

Bronze Sandcastle targets organizations across Asia and Africa, with confirmed victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea between August 2025 and August 2026. The geographic distribution and operational timeframe (UTC+8) align with Chinese state-sponsored espionage objectives in regions of strategic interest to China. The targeting pattern suggests intelligence collection focused on geopolitical and economic interests in developing regions where Chinese influence operations are active. No specific sector focus is documented, indicating broad opportunistic targeting or intelligence requirements across multiple industries in these regions.

Historical Context

Bronze Sandcastle represents a previously undocumented threat cluster within the broader landscape of Chinese APT activity. While DLL sideloading is a well-established technique among Chinese threat actors, Bronze Sandcastle's consistent use of Sandboxie specifically distinguishes it from related groups. Notably, APT41 previously leveraged Sandboxie executables (taskhost.exe) in July 2024 to sideload malicious sbiedll.dll and deploy the MoonWalk backdoor, suggesting possible shared tooling or techniques within the Chinese threat ecosystem. However, Bronze Sandcastle's operational patterns, infrastructure, and payload versions (1.1.5 and 1.1.7) indicate a distinct operational cluster. The group's reliance on legitimate cloud services and GitHub for C2 reflects an evolution in Chinese APT tradecraft toward living-off-the-land and blending with legitimate traffic.

Defensive Recommendations

  • Monitor for DLL sideloading behavior (T1574.002) by detecting legitimate signed executables loading DLLs from non-standard paths, particularly Sandboxie (SandboxieWUAU.exe/sbiedll.dll), Java (javaw.exe/jli.dll), Sysinternals tools (vmmap.exe/version.dll, bginfo64.exe/snmpapi.dll), and NVDA (NvdaHelper.exe/NvdaHelperRemote.dll)
  • Detect DLLs reading local configuration files (e.g., config.ini) followed by immediate in-memory execution using behavioral EDR rules, as this indicates payload decoding and staging activity (T1027, T1620)
  • Implement network monitoring for connections to file-sharing services (file.io, gofile.io, ably.net/io) and GitHub API requests from unexpected processes, particularly those associated with legitimate signed applications
  • Hunt for historical C2 domains dc.cathaypacifice[.]com and net.dpworldto[.]com, and investigate GitHub account LatonyCharnleyaW for related infrastructure patterns
  • Enable application whitelisting and DLL search order hardening via SafeDllSearchMode and CWDIllegalInDllSearch registry settings to prevent DLL sideloading exploitation

---

# Geopolitical Context

Geopolitical Context

Bronze Sandcastle represents a previously undocumented China-aligned cyber espionage cluster active since mid-2025, with operational patterns consistent with Beijing's sustained intelligence collection priorities across developing regions. The campaign's geographic focus—spanning the Philippines, Taiwan, Afghanistan, and Namibia—aligns with China's strategic interests in the Indo-Pacific theater and expanding influence corridors in Africa. The threat actor's UTC+8 operational tempo and technical sophistication suggest state-aligned resourcing. The targeting of Taiwan is consistent with persistent PRC intelligence operations against the island, while operations in the Philippines and Afghanistan may reflect efforts to monitor regional security dynamics and Belt and Road Initiative equities. African targeting in Namibia underscores China's interest in resource-rich states and emerging markets where Western cybersecurity maturity remains limited.

State Actor Alignment

Bronze Sandcastle is attributed by Sophos to China-aligned threat actors based on operational patterns, targeting, and technical tradecraft. The cluster's reliance on DLL sideloading mirrors techniques employed by established PRC-nexus groups, including APT41, which previously weaponized Sandboxie executables in July 2024. While no formal government attribution has been published, the threat actor's focus on espionage-oriented collection—network enumeration, credential harvesting, keystroke logging, and screenshot capture—is consistent with intelligence requirements typical of state-sponsored operations. The campaign does not appear to be subject to public sanctions designations at this time, though victims in Taiwan and the Philippines may fall under existing US-China strategic competition frameworks.

Business Impacty pro region

The campaign's dual focus on Asia and Africa presents distinct regional security challenges. In Asia, targeting of Taiwan and the Philippines occurs amid heightened cross-Strait tensions and evolving US-Philippines defense cooperation, suggesting intelligence collection may support PRC strategic planning in contested maritime domains. Afghan targeting may relate to monitoring of regional instability and Chinese economic interests following the 2021 Taliban takeover. In Africa, Namibia's inclusion reflects China's deepening economic and political engagement on the continent, where cybersecurity infrastructure often lags behind threat actor capabilities. For European stakeholders, the campaign underscores risks to multinational corporations and diplomatic missions operating in targeted regions, particularly those with limited endpoint detection capabilities. The use of publicly available file-sharing services (file.io, gofile.io) and GitHub for command-and-control infrastructure highlights how adversaries exploit legitimate platforms to evade network-based defenses, complicating attribution and disruption efforts across jurisdictions.

Forecast

If Bronze Sandcastle maintains current operational tempo, additional victims in Southeast Asia and sub-Saharan Africa are likely to emerge over the next six to twelve months, particularly in sectors aligned with Chinese strategic interests such as telecommunications, energy, and government administration. The threat actor's iterative payload development—evidenced by versioning from 1.1.5 to 1.1.7—suggests ongoing tooling refinement and potential expansion of capabilities. If Western intelligence agencies or cybersecurity vendors increase disclosure of Bronze Sandcastle infrastructure and techniques, the group may shift to alternative DLL sideloading vectors or adopt more sophisticated anti-analysis measures. Organizations in targeted regions should anticipate continued exploitation of trusted, signed binaries and encrypted configuration files to bypass static detection. If geopolitical tensions in the Taiwan Strait or South China Sea escalate, targeting intensity against regional government and defense-adjacent entities may increase correspondingly.