A China-aligned threat cluster known as Bronze Sandcastle has been observed targeting organizations in Asia and Africa since mid-2025.
Sophos security researcher Gabor Szappanos stated that the most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading to deploy backdoors.
“The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading”
Sources and references
Original report
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00C8W6P9
Cite this
APA
Interestana AI Editorial. (2026, October 21). Bronze Sandcastle Uses Sandboxie DLL Sideloading for Backdoors. Interestana. https://interestana.com/articles/china-aligned-bronze-sandcastle-abuses-sandboxie-dll-sideloading-to-deploy-backdoors-00c8w6p9
MLA
“Bronze Sandcastle Uses Sandboxie DLL Sideloading for Backdoors.” Interestana, 21 Oct. 2026, interestana.com/articles/china-aligned-bronze-sandcastle-abuses-sandboxie-dll-sideloading-to-deploy-backdoors-00c8w6p9.
Chicago
Interestana AI Editorial. “Bronze Sandcastle Uses Sandboxie DLL Sideloading for Backdoors.” Interestana, October 21, 2026. https://interestana.com/articles/china-aligned-bronze-sandcastle-abuses-sandboxie-dll-sideloading-to-deploy-backdoors-00c8w6p9.
BibTeX
@misc{interestana_00c8w6p9,
author = {{Interestana AI Editorial}},
title = {{Bronze Sandcastle Uses Sandboxie DLL Sideloading for Backdoors}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/china-aligned-bronze-sandcastle-abuses-sandboxie-dll-sideloading-to-deploy-backdoors-00c8w6p9},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html}
}Credit the source
Original reporting: The Hacker News, “China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors”, https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe