China-Based Group BRONZE SANDCASTLE Hides Backdoors Inside Trusted Software

Researchers from the Sophos Counter Threat Unit and SophosLabs have investigated a cluster of incidents linked to BRONZE SANDCASTLE, a China-based threat group. Its most distinctive marker is the repeated use of Sandboxie DLL sideloading. In this technique, a legitimate Sandboxie program is placed next to a malicious file named sbiedll.dll, so the trusted application loads the attacker's code when it runs. The group also uses several other file combinations for the same purpose.

The malicious files typically read and run a hidden payload stored in an encrypted config.ini file. According to Sophos, this design makes the attack harder to detect with static scanning and lets the operators change behaviour without replacing the DLL itself. Legitimate programs are often renamed to blend into the victim's environment, and running them results in code executing in memory rather than leaving extra files on disk. In one example, a ZIP archive contained a clean loader (javaw.exe), a sideloaded DLL (jli.dll) and the encrypted config.ini file.

The malicious DLL also uses obfuscation to hide its logic and frustrate analysis. Once the DLL decodes the config.ini file, the payload is a backdoor program. In memory it superficially resembles a Windows executable. This is only the opening section of the Sophos research, so further details are not covered here.