Threat reportAPTTL-2026-4036
BRONZE SANDCASTLE Intrusions: Active Directory Database (ntds.dit) Theft via DLL Sideloading and Modified Meterpreter
BRONZE SANDCASTLE Intrusions (TL-2026-4036), also tracked as BRONZE SANDCASTLE Meterpreter intrusions, is a high-severity advanced persistent threat campaign, first published 2026-10-21 and last reviewed 2026-10-22. It is attributed to BRONZE SANDCASTLE (China) with medium confidence, affects Microsoft Windows / Active Directory Domain Services (ntds.dit, maps to 17 MITRE ATT&CK techniques (T1003.003, T1016, T1027), and is covered by 9 detection rules and 36 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 1BRONZE SANDCASTLE
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 36Indicators of compromise
Key facts for TL-2026-4036
- Threat ID
- TL-2026-4036
- Also known as
- BRONZE SANDCASTLE Meterpreter intrusions
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- BRONZE SANDCASTLE
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, unspecified-organizations
- Target regions
- philippines, taiwan, afghanistan, namibia, south korea
- Detection rules
- 9
- Indicators of compromise
- 36
- Updates
- 2026-10-22 · revalidated 1× · latest source
Malware and tooling in BRONZE SANDCASTLE Intrusions
Malware and tooling: ATK/Swrort-Y, Meterpreter (Android), COFFLoader, NVDA (Non-Visual Desktop Access), metasploit
How BRONZE SANDCASTLE Intrusions works
Sophos Counter Threat Unit reports BRONZE SANDCASTLE, a suspected China-based group active August 2025 to August 2026, sideloading malicious DLLs (notably sbiedll.dll via Sandboxie executables) to reflectively load modified Meterpreter backdoors (v1.1.5, v1.1.7). Operators enumerated accounts and networks, then used vssadmin to create Volume Shadow Copies and copy the Active Directory ntds.dit database. Confirmed victims are in the Philippines, Taiwan, Afghanistan and Namibia, with South Korea likely.
BRONZE SANDCASTLE is a threat group that Sophos Counter Threat Unit (CTU) assesses as likely China-based, citing victimology and activity concentrated in UTC+8 working hours (consistent with the '996' working schedule). Sophos tracked intrusions between August 2025 and August 2026 against organizations in Asia and Africa: confirmed victims in the Philippines, Taiwan, Afghanistan and Namibia, and South Korea as a likely victim location. Geographic overlap exists with BRONZE PRESIDENT (HoneyMate / Mustang Panda) and BRONZE ATLAS, but Sophos states the overlap is insufficient to establish shared operators and no reliable linkage was established; the group is therefore tracked separately.
The group's most distinctive marker is repeated DLL sideloading of Sandboxie executables: SandboxieWUAU.exe or a renamed Start.exe is placed beside an attacker-controlled sbiedll.dll. Other legitimate applications are paired with malicious DLLs in the same way: javaw.exe with jli.dll (delivered in an archive named aez.zip alongside an encrypted config.ini), Krita.exe with Krita.dll, NvdaHelper.exe with NvdaHelperRemote.dll, Jcef_helper.exe with Libcef.dll, Vmmap.exe with Version.dll, LineAppMgr.exe with msvcp140.dll, and bginfo64.exe with snmpapi.dll. Sophos' IOC file also lists CoreFoundation.dll and MSIMG32.dll loaders.
Infection chain: the sideloaded DLL reads an encrypted config.ini from the local directory, decrypts the payload at runtime, and a position-independent reflective PE loader maps the embedded backdoor into memory, so the final payload is not written to disk in clear form. The loaders use flattened control flow built around a virtualized state machine (byte swaps, rotations, inversion and negation feeding indirect jump-table destinations) to hinder static analysis. The payload is structurally similar to stageless Metasploit Meterpreter but uses custom API-resolution hashing and transformation routines instead of the standard ROR13 algorithm, and includes elements associated with TrustedSec's COFFLoader, enabling Beacon Object File (BOF) execution without a Cobalt Strike agent. Sophos identified payload versions 1.1.5 and 1.1.7.
Command and control: v1.1.5 communicates with the C2 domains dc.cathaypacifice.com and net.dpworldto.com (lookalikes of Cathay Pacific and DP World names). v1.1.7 was observed contacting file.io, gofile.io, ably.net, ably.io and github.com; the GitHub account LatonyCharnleyaW hosted encrypted configuration files disguised as .js.map, .ts and README.md files, potentially hosting additional implants and C2 tasking. Both versions send structured JSON host profiling data: hostname, username, GUID, domain, OS version, internal and public IP addresses, process list with metadata, CPU architecture and code page.
Post-exploitation: operators ran Windows net commands to enumerate accounts and network resources, used vssadmin.exe to create Volume Shadow Copies, and copied the Active Directory database ntds.dit, placing domain credentials at risk. Sophos countermeasures cited: ATK/Swrort-Y, ATK/ScLoad-W/X/Y/Z and Troj/Loader-JL/-JP. No CVE is associated; the intrusion initial access vector was not stated in the sources reviewed. Note: this record is built from the Sophos report, its IOC CSV and secondary coverage (GBHackers, Hackread, Cyberpress); BeaconBeagle returned no config matches for the two C2 domains.
MITRE ATT&CK techniques used in TL-2026-4036
Credential Access
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087.001 Local Account; T1087.002 Domain Account
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036.003 Masquerading: Rename Legitimate Utilities; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL; T1574.002 Hijack Execution Flow: DLL Side-Loading; T1620 Reflective Code Loading
Command and Control
T1102.002 Bidirectional Communication
Execution
stealth
Resource Development
Affected products and versions in BRONZE SANDCASTLE Intrusions
- Microsoft — Windows / Active Directory Domain Services (ntds.dit exposure)
Vulnerable versions: Not version-specific; configuration and post-compromise abuse
Remediation for BRONZE SANDCASTLE Intrusions
Immediate actions
- Hunt for sbiedll.dll, jli.dll, Krita.dll, NvdaHelperRemote.dll, Libcef.dll, Version.dll, msvcp140.dll, snmpapi.dll, CoreFoundation.dll and MSIMG32.dll loaded from non-standard directories by Sandboxie, Java, Krita, NVDA, LINE or Sysinternals binaries
- Block and alert on DNS/proxy traffic to dc.cathaypacifice.com and net.dpworldto.com
- Alert on unexpected vssadmin.exe shadow copy creation and reads/copies of ntds.dit on domain controllers
- If ntds.dit theft is suspected, treat all domain credentials as compromised and plan krbtgt and privileged account resets
Workarounds
- Application allow-listing to block execution of legitimate signed binaries from user-writable or unusual directories
Longer-term hardening
- Deploy EDR with behavioral detection for DLLs reading local config files followed by in-memory execution, reflective loading and anomalous PE headers in memory
- Restrict and monitor access to domain controllers and shadow copy tooling
- Monitor or restrict access to file.io, gofile.io, ably.net/ably.io and raw GitHub content where not business-required
Weaknesses (CWE) in BRONZE SANDCASTLE Intrusions
Timeline of BRONZE SANDCASTLE Intrusions
- Start of the period (August 2025) in which Sophos CTU tracked BRONZE SANDCASTLE intrusions; exact first-activity day not stated
- End of the tracked activity period (August 2026); victims confirmed in the Philippines, Taiwan, Afghanistan and Namibia, South Korea likely
- The Hacker News reports the LatonyCharnleyaW GitHub account used for Meterpreter 1.1.7 config retrieval is no longer accessible as of publication.
- Report attributes v1.1.5 to C2 domains dc.cathaypacifice.com and net.dpworldto.com and v1.1.7 to file.io, gofile.io, ably.net/ably.io and GitHub account LatonyCharnleyaW; BeaconBeagle shows no config matches for the two domains
- Sophos documents protections ATK/Swrort-Y, ATK/ScLoad-W/X/Y/Z and Troj/Loader-JL/-JP and recommends behavioral detection of DLLs reading local config files followed by in-memory execution
- Sophos CTU assesses the group as likely China-based (UTC+8 working-hours activity, victimology) and tracks it separately from BRONZE PRESIDENT and BRONZE ATLAS, whose geographic overlap is insufficient to establish shared operators
- GBHackers, Hackread, Cyberpress and Mallory report on the campaign; ntds.dit theft via vssadmin shadow copies highlighted
- SophosLabs publishes BRONZESANDCASTLE_Meterpreter_IOCs.csv with loader/payload hashes and the two C2 domains
- Sophos CTU publishes 'BRONZE SANDCASTLE deploys modified Meterpreter shells' describing Sandboxie DLL sideloading and Meterpreter v1.1.5/v1.1.7
Update history for TL-2026-4036
- 2026-10-22 — China-Linked BRONZE SANDCASTLE Abuses Trusted Windows Applications via DLL Sideloading to Deploy Modified Meterpreter and Steal AD Credentials: What changed No severity, exploitability, status or attribution change; record enriched with additional evidenced detail. New indicators (3) config.ini (encrypted payload filename), vssadmin.exe create shadow behavior, and the modified Mete
Sources cited for BRONZE SANDCASTLE Intrusions
- BRONZE SANDCASTLE deploys modified Meterpreter shells (Sophos CTU)
- SophosLabs IoCs: BRONZESANDCASTLE_Meterpreter_IOCs.csv
- BRONZE SANDCASTLE Hackers Steal Active Directory Database Using Hidden Windows Backdoors (GBHackers)
- China-Based BRONZE SANDCASTLE Hackers Abuse Sandboxie to Load Backdoors (Hackread)
- Chinese Espionage Hackers Use Modified Meterpreter Malware to Target Organizations in Asia and Africa (Cyberpress)
- BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter (Mallory)
- Operator's Guide to the Meterpreter BOFLoader (TrustedSec)
- Metasploit Meterpreter execute_bof command documentation
Detection coverage for TL-2026-4036
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4036 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.