BRONZE SANDCASTLE: Sandboxie DLL Sideloading Chain and Detection Checks

Sophos CTU describes a China-attributed APT named BRONZE SANDCASTLE active in Aug 2025–Aug 2026 that abuses trusted programs (notably Sandboxie) via DLL sideloading to decrypt and reflectively load a Meterpreter-based backdoor in memory; the report details the infection chain, targeted countries (Philippines, Taiwan, Afghanistan, Namibia and likely South Korea), IOCs (loader/payload hashes, C2 domains, GitHub config fetch), post-compromise behaviour including AD data theft (ntds.dit), and practical hunting/response checks.