Security researchers have documented a previously unknown China-aligned threat cluster dubbed Bronze Sandcastle. According to the report, the group has been active since mid-2025 and has targeted organizations in Asia and Africa.
The campaign's most distinctive technical marker is its abuse of Sandboxie, a legitimate Windows sandboxing tool, through DLL sideloading. By placing a malicious DLL where the application expects a legitimate one, the attackers can execute their own payload and deploy backdoors on compromised systems.
The findings come from a single disclosure, and the report does not provide details on the full scope of the campaign or the ultimate purpose of the backdoors. The case nonetheless illustrates how attackers continue to repurpose trusted software components to evade detection.