Loading story…
BRONZE SANDCASTLE, a suspected China-based threat group, targeted organizations in Asia and Africa between August 2025 and August 2026 using modified Meterpreter shells, according to an investigation by Sophos Counter Threat Unit and SophosLabs. The attackers used legitimate Sandboxie executables to sideload malicious sbiedll.dll files, which decoded encrypted payloads and executed a backdoor in memory. The backdoor collected detailed host information and supported reconnaissance and data theft, using attacker-controlled domains and legitimate online services for communications or configuration retrieval.
Researchers observed network and account enumeration, as well as the creation of Volume Shadow Copies followed by copying Active Directory’s ntds.dit database—activity that puts domain credentials at risk. Geographic targeting and activity concentrated in UTC+8 supported the suspected China-based attribution, but researchers could not reliably link the operation to BRONZE PRESIDENT or BRONZE ATLAS. Sophos recommended behavioral endpoint monitoring and memory-based detection, as runtime decryption and reflective loading can undermine static file-based detection.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers attributed the intrusions to the separately designated BRONZE SANDCASTLE group and assessed it as likely China-based, citing targeting and UTC+8 activity patterns. Their report detailed its custom payloads and infrastructure but found insufficient evidence to link the activity reliably to BRONZE PRESIDENT or BRONZE ATLAS.
After deploying the payload, BRONZE SANDCASTLE executed Windows net commands to enumerate networks and user accounts. The operators also created Volume Shadow Copies using vssadmin.exe before copying ntds.dit, which contains Active Directory credentials and domain information.
BRONZE SANDCASTLE used legitimate Sandboxie and other executables to sideload malicious DLLs that decrypted payloads from config.ini files and executed them in memory. Researchers identified custom Meterpreter-based payload versions 1.1.5 and 1.1.7 with reconnaissance and data-stealing capabilities.
CTU analyzed intrusions spanning August 2025 through August 2026 involving victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely the Republic of Korea.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourceinfosec.pub
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **ShadowPad**, a modular remote access trojan active since at least 2017, has been used by the Chinese threat group **BRONZE ATLAS**—also tracked as **APT41**, **Axiom**, **Winnti**, and **Wicked Panda**—and later adopted by multiple other Chinese espionage clusters. Secureworks and Sophos said the malware is commonly deployed through **DLL sideloading** and **DLL search order hijacking** with legitimate executables, using two-file and three-file execution chains, in-memory payload decryption, persistence through Windows services and registry keys, and process injection into child processes. The reporting links separate ShadowPad activity clusters to actors aligned with China’s **Ministry of State Security** and to **PLA-affiliated** groups whose targeting maps to Northern, Southern, and Western Theater Command regions.
May 25, 2026
**Silver Dragon**, an emerging China-linked threat actor assessed as part of the **APT41** ecosystem, has conducted cyberespionage operations against **government entities in Europe and Southeast Asia** since at least mid-2024. Reporting based on Check Point research says the group gains initial access through a mix of **exploitation of public-facing servers** and **phishing emails with malicious attachments**, then blends into normal activity by **hijacking legitimate Windows services** for persistence and command-and-control (C2). The activity includes a toolchain that uses **heavily obfuscated loaders** (including **MonikerLoader** and **BamboLoader**) to decrypt and inject payloads in memory, with **Cobalt Strike** beacons commonly deployed as a final-stage payload. Check Point also observed **Google Drive-based C2** as an evasion technique, alongside Cobalt Strike configurations that can use **DNS tunneling**, **HTTP via Cloudflare**, or **SMB** for internal communications; additional custom post-exploitation tooling (e.g., screenshot capture utilities) was also reported, and artifacts suggested an **automated framework** for generating per-target attack packages (e.g., consistent file timestamps and recovered configuration logs with paths, service names, keys, and injected processes).
Mar 4, 2026
Trend Micro disclosed that the China-aligned cluster **SHADOW-EARTH-053** compromised more than a dozen organizations in at least eight countries by exploiting vulnerable Microsoft Exchange and IIS servers, including the `ProxyLogon` chain, then deploying **GODZILLA** web shells and the **ShadowPad** backdoor to maintain access. Victims included government agencies, defense contractors, technology firms, transportation organizations, and at least one target in Poland, with activity observed from December 2024 through April 2026. Researchers said the intrusions resemble broader Chinese state-linked operations such as Salt Typhoon and Volt Typhoon and may support long-term espionage, prepositioning, and potential future disruption. Post-compromise activity included DLL sideloading with a renamed Toshiba Bluetooth Stack executable, registry-resident shellcode execution via `EnumDesktopsA` callback injection, scheduled-task persistence, mailbox collection from Exchange, credential theft, and lateral movement using tools such as **IOX**, **GOST**, **Wstunnel**, **Sharp-SMBExec**, **Mimikatz**, and **Evil-CreateDump**. Trend Micro also identified overlap with a related cluster, **SHADOW-EARTH-054**, including shared tool hashes, reused vulnerabilities, and compromises at some of the same organizations, although the company assessed the relationship as overlapping exploitation rather than clearly coordinated operations. Defenders were urged to patch Exchange and IIS systems quickly and review IIS worker process activity, web-shell indicators, and other signs of stealthy post-exploitation.
May 6, 2026