Loading threat actor…
BRONZE SANDCASTLE is a China-linked threat group observed compromising organizations in Asia and Africa between August 2025 and August 2026, including victims in the Philippines, Taiwan, Afghanistan, and Namibia. It is tracked separately from BRONZE PRESIDENT and BRONZE ATLAS; overlapping geographic targeting does not establish a relationship with either group. The group's distinctive technique is DLL sideloading through legitimate Sandboxie executables, alongside sideloading through other trusted Windows applications. Malicious libraries decrypt locally stored payloads and execute customized Meterpreter-based backdoors in memory using reflective loading. The loaders employ control-flow obfuscation, while executable renaming and encrypted payload storage help evade detection. Separating loaders from encrypted payloads allows operators to change payload behavior without replacing the loading libraries. Identified backdoor versions include 1.1.5 and 1.1.7, with the latter retrieving encrypted configurations through GitHub. The backdoors collect and transmit detailed host, user, domain, operating-system, and process information. Post-compromise activity includes account and network enumeration using native Windows commands and credential theft through creation of Volume Shadow Copies followed by copying the Active Directory database.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 malware families attributed to this actor across reporting.
11 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-linked activity cluster observed between August 2025 and August 2026 using DLL sideloading to deploy hidden backdoors, collect system information, and steal Active Directory credential data. Reported victims were in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Sophos could not reliably link the activity to BRONZE PRESIDENT or BRONZE ATLAS.
Deploys modified Meterpreter shells; the provided content gives no further operational or attribution details.
Assessed as a China-based threat group conducting intelligence-gathering and data theft against organizations in Asia and Africa. Incidents observed between August 2025 and August 2026 involved encrypted payloads, DLL sideloading, a custom Meterpreter-based backdoor, network reconnaissance, and theft of Active Directory credential data. Researchers designated it separately because its distinctive activity could not be reliably linked to BRONZE PRESIDENT or BRONZE ATLAS.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.