Sophos Says China-Based BRONZE SANDCASTLE Side-Loads Through Sandboxie and Seven Other Trusted Apps to Run a Custom Meterpreter-Style Backdoor That Pulls Encrypted Configs From GitHub

LONDON - A China-based espionage group that Sophos now tracks as BRONZE SANDCASTLE has spent at least a year hiding a custom backdoor behind trusted software, most consistently Sandboxie, according to research the company published on Oct. 20. Sophos' Counter Threat Unit and SophosLabs said the group's loaders read encrypted configuration files and run the payload in memory, a design meant to leave little for file scanners to find.

The researchers said they created the separate BRONZE SANDCASTLE designation because the activity, although its geography overlaps with that of the China-based groups BRONZE PRESIDENT and BRONZE ATLAS, could not be reliably linked to either and had distinctive technical traits. Incidents analyzed between August 2025 and August 2026 included victims in the Philippines, Taiwan, Afghanistan and Namibia, and likely South Korea.

Nine pairings, one pattern

The group's signature, Sophos said, is placing legitimate Sandboxie executables beside a malicious sbiedll.dll so the trusted program loads attacker code at runtime. It is not the only carrier. Sophos listed nine pairings in all, among them a Java javaw.exe with a malicious jli.dll, the Krita painting program, the NVDA screen reader's helper, a Java Chromium Embedded Framework helper, the LINE messaging app's manager, and two Sysinternals utilities, VMMap and BgInfo, loading version.dll and snmpapi.dll. Renamed legitimate executables, such as a Sandboxie binary renamed start.exe, help the files blend in.

In one sample, a ZIP archive named aez.zip held the clean javaw.exe loader, the side-loaded jli.dll and an encrypted config.ini. Sophos' diagram of that case shows the files written by dllhost.exe, the Windows COM Surrogate, into C:\ProgramData\Microsoft\AppV.

The side-loaded DLLs are hard to read by design. Sophos said the code uses a flattened control-flow dispatcher: a state machine passes values through a custom bit-mixing routine and jumps indirectly through a table of code pointers, with some entries deliberately resolving to fall-through locations.

A Meterpreter look-alike that is not Meterpreter

Once decoded, config.ini looks like a Windows executable in memory, but its header is a reflective loader. Sophos said the payload resembles stageless Metasploit shellcode in its position-independent execution, manual PE validation and in-memory loading. It differs in ways that matter to detection engineers: its API resolution uses non-standard hashing and transformation routines rather than the ROR13 algorithm Metasploit uses, and the code is much larger and more complex. The samples also carry elements of the open-source COFFLoader project, which Sophos said suggests the author wrote a custom Beacon Object File to add post-exploitation features.

Sophos identified two payload versions, 1.1.5 and 1.1.7. On start, the backdoor sends its command-and-control server a JSON object with a nested "info" block covering hostname, username, GUID and domain; OS version; internal and public IP addresses; the process list; working directory; code page; CPU architecture; implant start time; and whether it is running as server or client.

Sophos said it saw the payload reach out to legitimate services, including file[.]io, gofile[.]io, ably[.]net and ably[.]io, possibly to receive tasking. Version 1.1.5 contacted dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com, domains whose names resemble those of Cathay Pacific and DP World. Version 1.1.7 fetched encrypted configuration files from a GitHub account, LatonyCharnleyaW, that had little history; the repository also held encrypted .ts files that may be implants.

After installation, the operators ran Windows "net" commands to enumerate the network and accounts, created volume shadow copies with vssadmin.exe and then copied ntds.dit, the Active Directory database that holds user credentials, group policies and domain configuration.

Why file hashes will not carry the hunt

Sophos was blunt that static detection is a weak fit. Because the group relies on encrypted payload and configuration files decoded at runtime, "static file-based detections may be ineffective," the researchers wrote. They recommended behavioral detection instead, including DLLs that read local files and then immediately execute code in memory, and monitoring for reflective loading patterns, anomalous PE headers in memory and processes that behave like position-independent shellcode.

What defenders should do

• Alert when a known side-load carrier, such as SandboxieWUAU.exe, a renamed start.exe, javaw.exe, VMMap or bginfo64.exe, runs from a user-writable or unusual folder and loads a DLL from its own directory, especially next to a config.ini.
• Treat dllhost.exe writing executables and DLLs into C:\ProgramData\Microsoft\AppV as suspicious, as in the case Sophos diagrammed.
• Lean on memory telemetry: reflective loading, PE headers in private memory regions, and a DLL file read followed at once by in-memory execution, per Sophos.
• Watch for workstation processes pulling content from GitHub's API or from file[.]io, gofile[.]io or ably endpoints when no business process explains it, and search logs for dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com.
• Hunt for vssadmin.exe creating shadow copies followed by access to ntds.dit outside backup jobs, and for bursts of "net" enumeration commands.
• Pull the full indicator list from the SophosLabs GitHub repository; Sophos detects the components as ATK/Swrort-Y, ATK/ScLoad-W through ATK/ScLoad-Z, Troj/Loader-JL and Troj/Loader-JP.