Sophos attributes a China-aligned cluster Bronze Sandcastle (active ~Aug 2025–Aug 2026) that consistently sideloads via Sandboxie (SandboxieWUAU.exe/Start.exe + malicious sbiedll.dll), plus other pairs (javaw.exe/jli.dll, Krita.exe/Krita.dll, Vmmap.exe/Version.dll, bginfo64.exe/snmpapi.dll, etc.). Sideloaded DLLs decode encrypted config.ini payloads into reflective, Metasploit-like stageless shellcode with custom API hashing and COFFLoader/BOF features. C2 patterns include file[.]io, gofile[.]io, ably[.]net/io, and GitHub raw configs; older builds used dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Post-compromise: net enumeration, vssadmin + ntds.dit theft. Victims in PH, TW, AF, NA, likely KR; UTC+8 activity hours.

1. EDR: legitimate signed Sandboxie/Java/Krita/Sysinternals binaries loading DLLs from unusual directories (user profile, temp, ProgramData).
2. File: sbiedll.dll, config.ini next to renamed Sandboxie loaders; ZIP droppers named like aez.zip.
3. Memory: reflective PE loaders / position-independent shellcode after a sideload; strings for host/user/GUID/domain telemetry.
4. Network: outbound to file-hosting/CDN and newly created GitHub repos (example in report: LatonyCharnleyaW) right after sideload.
5. AD: vssadmin shadow copy creation preceding ntds.dit access.

Full IOC list: SophosLabs GitHub (linked from the blog).