Sophos has named a China-aligned intrusion set it calls Bronze Sandcastle, and the tradecraft is less spy movie than office supply closet. The crew dropped legitimate Sandboxie binaries into victim environments beside a malicious sbiedll.dll, so the signed executable did the loading.
Researchers logged victims in the Philippines, Taiwan, Afghanistan and Namibia between August 2025 and August 2026, with activity clustering in the UTC+8 time zone and likely reach into South Korea. Gabor Szappanos of Sophos called Sandboxie sideloading the group’s most consistent fingerprint.
Seven more signed hosts did the same job
Sandboxie was only the loudest example. The operators paired javaw.exe with jli.dll, Krita.exe with Krita.dll, NvdaHelper.exe with NvdaHelperRemote.dll, and worked the same trick on Jcef_helper.exe, Vmmap.exe, LineAppMgr.exe and bginfo64.exe. Every pairing puts a signed process in front of attacker code.
The sideloaded modules read encrypted config.ini files and unpack an in-memory payload, tracked at versions 1.1.5 and 1.1.7, that enumerates local accounts and the network, harvests keystrokes and screenshots, and takes fresh tasking over file-sharing and messaging APIs. One build pulled its encrypted config from a GitHub repository through the API.
Because nothing suspicious lands on disk in usable form, static signatures have little to bite on. Sophos recommends hunting behavioural signatures instead: a DLL reading local files and immediately executing code in memory. Patching alone will not close this, and no CVE is involved. The exposure sits in how Windows resolves library paths, which is not new. Sandboxie’s signed binaries were abused the same way by APT41 in 2024 to deliver MoonWalk.
