China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

A previously undocumented China-aligned threat cluster called Bronze Sandcastle has been identified targeting organizations in Asia and Africa since mid-2025. The group's most distinctive technical marker is its consistent use of Sandboxie DLL sideloading techniques to deploy backdoors. The campaign was disclosed by Sophos security researcher Gabor Szappanos. The threat actor is assessed to be aligned with Chinese state interests. The targeting pattern focuses on organizations across Asian and African regions. DLL sideloading via the legitimate Sandboxie application is used as a mechanism to load malicious payloads stealthily. This technique helps the attackers evade detection by abusing trusted software. The activity represents a newly documented cluster not previously attributed or tracked publicly.