Intelligence update: October 21, 2026

One newly disclosed cyberespionage cluster meets the watch criteria: BRONZE SANDCASTLE, publicly identified by Sophos Counter Threat Unit (CTU) and SophosLabs on October 20, 2026.

Sophos established the designation after investigating intrusions across Asia and Africa between August 2025 and August 2026. The actor uses DLL sideloading, encrypted in-memory backdoors, and Active Directory credential collection.

Why this qualifies: Sophos explicitly created BRONZE SANDCASTLE as a separate tracking designation because the activity could not reliably be attributed to existing China-linked groups, including BRONZE PRESIDENT and BRONZE ATLAS. This is a new vendor-designated cluster, not simply a new campaign attributed to an established APT. SOPHOS

1. Threat actor intelligence profile

Intelligence field Assessment

Actor designation BRONZE SANDCASTLE

Tracking organization Sophos Counter Threat Unit

Known aliases None publicly confirmed

First observed August 2025

Last documented activity August 2026

Public disclosure October 20, 2026

Suspected country/nexus China-aligned; exact organizational affiliation unknown

Motivation Suspected cyberespionage and intelligence collection

Target countries Philippines, Taiwan, Afghanistan, Namibia; likely South Korea

Target sectors Multiple organizational environments; specific industries not disclosed

Primary malware Custom Meterpreter-like backdoor, versions 1.1.5 and 1.1.7

Additional tooling Malicious DLL loaders, encrypted configuration files, GitHub-hosted payload configurations

Initial access Not established in the published investigation

Distinctive technique Sandboxie DLL sideloading

Attribution confidence High for cluster identification; China nexus supported by circumstantial evidence

State sponsorship Not independently established

Sophos observed operator activity concentrated in the UTC+8 time zone, consistent with China-based working hours. Regional victimology also supports the China-nexus assessment.

However, neither the operating hours nor the targeting geography identifies a specific intelligence service or government unit. SOPHOS

2. Distinctive attack methodology

DLL sideloading

BRONZE SANDCASTLE places legitimate Windows executables alongside malicious DLLs. When the legitimate application launches, it loads the attacker-controlled DLL.

The most distinctive combination is:

Legitimate executable Malicious DLL

SandboxieWUAU.exe sbiedll.dll

Start.exe — renamed Sandboxie executable sbiedll.dll

javaw.exe jli.dll

Krita.exe Krita.dll

NvdaHelper.exe NvdaHelperRemote.dll

Jcef_helper.exe Libcef.dll

Vmmap.exe Version.dll

LineAppMgr.exe msvcp140.dll

bginfo64.exe snmpapi.dll

The malicious DLL reads an encrypted config.ini file, decrypts the payload, and executes it in memory.

This avoids placing the final backdoor in a conventional executable file and reduces the effectiveness of signature-based detection.

The DLL also employs control-flow obfuscation involving indirect jumps and custom bit-manipulation routines, complicating reverse engineering. SOPHOS

Custom backdoor

Sophos identified two versions of the backdoor: 1.1.5 and 1.1.7.

The malware incorporates a reflective loader with characteristics resembling stageless Meterpreter shellcode, but Sophos determined that it is not a standard Metasploit artifact.

The implementation includes custom API resolution and elements associated with COFFLoader, suggesting development of custom post-exploitation capabilities.

The backdoor collects system information, including hostnames, usernames, domain membership, IP addresses, operating-system details, process information, and implant metadata.

Following deployment, the operators conduct internal reconnaissance and credential collection. Sophos observed the creation of Volume Shadow Copies before extraction of the Active Directory ntds.dit database.