China-Linked Hackers Exploit Windows Apps for Credential Theft

Key Takeaways

• A China-linked threat actor, BRONZE SANDCASTLE, is exploiting legitimate Windows applications to deploy stealthy backdoors and steal Active Directory credentials.
• The group utilizes DLL sideloading, placing malicious libraries alongside trusted software like Sandboxie, Java, and Microsoft Sysinternals, to execute attacker-controlled code.
• Observed attacks between August 2025 and August 2026 targeted organizations in the Philippines, Taiwan, Afghanistan, Namibia, and potentially South Korea.
• The custom Meterpreter-like payload collects extensive system information and facilitates the exfiltration of Active Directory database files.
• Defenders should prioritize monitoring for unusual library loading, reflective loading, and behavior consistent with credential theft and shadow copy abuse.

China-Linked Hackers Weaponize Trusted Windows Applications

A sophisticated threat group, identified as BRONZE SANDCASTLE and suspected of operating from China, has been observed leveraging legitimate Windows applications to establish covert backdoors, gather detailed system intelligence, and compromise Active Directory credential data.

The attackers employ a technique known as DLL sideloading. This involves strategically placing malicious Dynamic Link Libraries (DLLs) in directories alongside genuine, trusted software. When the legitimate application is launched, it inadvertently loads the attacker-supplied DLL, granting the adversaries control over the execution flow without altering the original, signed program. This method allows the malicious activity to blend seamlessly with normal system operations, making detection more challenging.

This campaign underscores a persistent trend where legitimate software is co-opted into attack chains. While similar DLL sideloading tactics have been observed in other China-linked operations, researchers emphasize that shared techniques alone do not definitively link BRONZE SANDCASTLE to other known groups.

Researchers from Sophos’ Counter Threat Unit and SophosLabs identified this malware during investigations into security incidents across various regions, including Asia and Africa. Their comprehensive technical report, released on October 20, details attacks that occurred between August 2025 and August 2026. Victims were located in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea.

Tactics and Abused Software

The most prominent technical signature of BRONZE SANDCASTLE’s operations is the use of Sandboxie for DLL sideloading. In these instances, legitimate Sandboxie executables were paired with malicious supporting libraries. Upon execution, the trusted Sandboxie program would load the rogue library, transferring control to the attackers. Beyond Sandboxie, the Sophos report also documents the abuse of components from a range of popular software, including Java, Krita, NVDA, LINE, and Microsoft Sysinternals.

The malicious libraries are designed to be modular. Typically, they retrieve an encrypted payload from a local configuration file, decrypt it, and then execute the code directly in memory. This design creates a clear separation between the visible, legitimate application and the hidden backdoor, enabling the threat actors to modify the payload’s behavior without needing to replace the initial loading library. Further enhancing their stealth, the attackers often rename executables to mimic benign system files, aiding in their evasion of detection within compromised environments.

Sophos notes a structural resemblance between BRONZE SANDCASTLE’s DLL sideloading campaigns and those observed in other ShadowPad operations, particularly the use of a three-part structure: a legitimate program, a malicious library, and an encrypted payload. However, due to insufficient evidence to definitively connect BRONZE SANDCASTLE’s observed activities to groups like BRONZE PRESIDENT or BRONZE ATLAS, Sophos tracks it as a distinct entity.

Modified Meterpreter Payload Steals System Data

The decoded backdoor, once executed, employs a reflective loader to inject an embedded Windows program directly into memory. While its overall structure bears a resemblance to standard Metasploit shellcode, Sophos analysts discovered custom function-resolution routines and a codebase that is significantly larger and more intricate than typical examples. Additionally, elements reminiscent of COFFLoader suggest the inclusion of custom functionalities tailored for post-compromise operations.

Sophos identified two payload versions in circulation: 1.1.5 and 1.1.7. Both versions are designed to exfiltrate extensive system information to their command-and-control (C2) servers. This data includes computer and user names, domain specifics, operating system version, both internal and public IP addresses, running process details, the current working directory, processor type, and system startup time.

Notably, version 1.1.5 communicated with dedicated control domains, while version 1.1.7 retrieved encrypted configuration files directly from GitHub. The threat actors may also have leveraged connections to legitimate file-sharing and messaging services to relay operator instructions, though Sophos has not definitively confirmed this functionality.

Following initial access, the BRONZE SANDCASTLE operators utilized standard Windows network commands for reconnaissance, inspecting user accounts and local network configurations. A critical step in their attack chain involved creating Volume Shadow Copies, a technique often employed before copying the Active Directory database (ntds.dit). This sequence of actions directly links the backdoor’s remote access capabilities to attempts at acquiring highly sensitive domain credential data. The abuse of Windows shadow copies is a known method for bypassing protections on database contents, highlighting the severity of this credential theft tactic.

Sophos advises organizations to implement robust detection mechanisms for libraries that read local files and immediately execute code in memory. Monitoring for unusual executable headers and reflective loading techniques is also crucial. Given the prevalence of encrypted payloads, behavioral and memory monitoring are particularly vital for mitigating the risk of static file detection evasion.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Implement robust endpoint detection and response (EDR) solutions capable of monitoring for unusual process behavior, particularly DLL sideloading and reflective code loading.
• Regularly audit and monitor Active Directory for suspicious access patterns, unauthorized shadow copy creation, and attempts to access or exfiltrate the ntds.dit file.
• Employ application whitelisting to restrict the execution of unauthorized software and control which DLLs can be loaded by legitimate applications.
• Ensure all operating systems and third-party applications are kept up-to-date with the latest security patches to mitigate known vulnerabilities.
• Educate users on the risks of social engineering and phishing attacks, which are often initial vectors for delivering malicious files that enable DLL sideloading.
• Utilize network segmentation to limit lateral movement within your environment, reducing the impact of a potential compromise.
• Actively monitor network traffic for connections to suspicious domains or unusual data exfiltration, including communications with legitimate services that could be abused.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.