# BRONZE SANDCASTLE Intrusions: Active Directory Database (ntds.dit) Theft via DLL Sideloading and Modified Meterpreter

> Sophos Counter Threat Unit reports BRONZE SANDCASTLE, a suspected China-based group active August 2025 to August 2026, sideloading malicious DLLs (notably sbiedll.dll via Sandboxie executables) to reflectively load modified Meterpreter backdoors (v1.1.5, v1.1.7). Operators enumerated accounts and networks, then used vssadmin to create Volume Shadow Copies and copy the Active Directory ntds.dit database. Confirmed victims are in the Philippines, Taiwan, Afghanistan and Namibia, with South Korea likely.

- **Published:** 2026-10-21T12:05:18Z
- **Last reviewed:** 2026-10-22T00:30:37.706Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4036
- **ID:** TL-2026-4036
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** BRONZE SANDCASTLE (China)
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BRONZE SANDCASTLE is a threat group that Sophos Counter Threat Unit (CTU) assesses as likely China-based, citing victimology and activity concentrated in UTC+8 working hours (consistent with the '996' working schedule). Sophos tracked intrusions between August 2025 and August 2026 against organizations in Asia and Africa: confirmed victims in the Philippines, Taiwan, Afghanistan and Namibia, and South Korea as a likely victim location. Geographic overlap exists with BRONZE PRESIDENT (HoneyMate / Mustang Panda) and BRONZE ATLAS, but Sophos states the overlap is insufficient to establish shared operators and no reliable linkage was established; the group is therefore tracked separately.

The group's most distinctive marker is repeated DLL sideloading of Sandboxie executables: SandboxieWUAU.exe or a renamed Start.exe is placed beside an attacker-controlled sbiedll.dll. Other legitimate applications are paired with malicious DLLs in the same way: javaw.exe with jli.dll (delivered in an archive named aez.zip alongside an encrypted config.ini), Krita.exe with Krita.dll, NvdaHelper.exe with NvdaHelperRemote.dll, Jcef_helper.exe with Libcef.dll, Vmmap.exe with Version.dll, LineAppMgr.exe with msvcp140.dll, and bginfo64.exe with snmpapi.dll. Sophos' IOC file also lists CoreFoundation.dll and MSIMG32.dll loaders.

Infection chain: the sideloaded DLL reads an encrypted config.ini from the local directory, decrypts the payload at runtime, and a position-independent reflective PE loader maps the embedded backdoor into memory, so the final payload is not written to disk in clear form. The loaders use flattened control flow built around a virtualized state machine (byte swaps, rotations, inversion and negation feeding indirect jump-table destinations) to hinder static analysis. The payload is structurally similar to stageless Metasploit Meterpreter but uses custom API-resolution hashing and transformation routines instead of the standard ROR13 algorithm, and includes elements associated with TrustedSec's COFFLoader, enabling Beacon Object File (BOF) execution without a Cobalt Strike agent. Sophos identified payload versions 1.1.5 and 1.1.7.

Command and control: v1.1.5 communicates with the C2 domains dc.cathaypacifice.com and net.dpworldto.com (lookalikes of Cathay Pacific and DP World names). v1.1.7 was observed contacting file.io, gofile.io, ably.net, ably.io and github.com; the GitHub account LatonyCharnleyaW hosted encrypted configuration files disguised as .js.map, .ts and README.md files, potentially hosting additional implants and C2 tasking. Both versions send structured JSON host profiling data: hostname, username, GUID, domain, OS version, internal and public IP addresses, process list with metadata, CPU architecture and code page.

Post-exploitation: operators ran Windows net commands to enumerate accounts and network resources, used vssadmin.exe to create Volume Shadow Copies, and copied the Active Directory database ntds.dit, placing domain credentials at risk. Sophos countermeasures cited: ATK/Swrort-Y, ATK/ScLoad-W/X/Y/Z and Troj/Loader-JL/-JP. No CVE is associated; the intrusion initial access vector was not stated in the sources reviewed. Note: this record is built from the Sophos report, its IOC CSV and secondary coverage (GBHackers, Hackread, Cyberpress); BeaconBeagle returned no config matches for the two C2 domains.

## MITRE ATT&CK

- T1574.001 DLL
- T1574.001 DLL
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1106 Native API
- T1003.003 NTDS
- T1087.002 Domain Account
- T1087.001 Local Account
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1102.002 Bidirectional Communication
- T1588.002 Tool
- T1574.002 Hijack Execution Flow: DLL Side-Loading
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1036.003 Masquerading: Rename Legitimate Utilities
- T1016 System Network Configuration Discovery

## Sources

- [BRONZE SANDCASTLE deploys modified Meterpreter shells (Sophos CTU)](https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells)
- [SophosLabs IoCs: BRONZESANDCASTLE_Meterpreter_IOCs.csv](https://raw.githubusercontent.com/sophoslabs/IoCs/master/BRONZESANDCASTLE_Meterpreter_IOCs.csv)
- [BRONZE SANDCASTLE Hackers Steal Active Directory Database Using Hidden Windows Backdoors (GBHackers)](https://gbhackers.com/bronze-sandcastle-intrusions/)
- [China-Based BRONZE SANDCASTLE Hackers Abuse Sandboxie to Load Backdoors (Hackread)](https://hackread.com/china-bronze-sandcastle-hackers-sandboxie-backdoors/)
- [Chinese Espionage Hackers Use Modified Meterpreter Malware to Target Organizations in Asia and Africa (Cyberpress)](https://cyberpress.org/chinese-hackers-deploy-meterpreter/)
- [BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter (Mallory)](https://mallory.ai/stories/01a15a1f-ba22-7069-8078-37a702e77af2)
- [Operator's Guide to the Meterpreter BOFLoader (TrustedSec)](https://trustedsec.com/blog/operators-guide-to-the-meterpreter-bofloader)
- [Metasploit Meterpreter execute_bof command documentation](https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-executebof-command.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4036