---
title: Hunt: Bronze Sandcastle Sandboxie DLL sideloading (sbiedll.dll) and reflective Meterpreter-like payloads | ctxsec
url: https://ctxsec.com/items/hunt-bronze-sandcastle-sandboxie-dll
description: ""
status: "hunt idea (Sophos CTU / SophosLabs Oct 21)"
published: 2026-10-21
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-bronze-sandcastle-sandboxie-dll.md)

hunt idea (Sophos CTU / SophosLabs Oct 21)

2026-10-21

### Hunt: Bronze Sandcastle Sandboxie DLL sideloading (sbiedll.dll) and reflective Meterpreter-like payloads

Sophos attributes a China-aligned cluster **Bronze Sandcastle** (active ~Aug 2025–Aug 2026) that consistently sideloads via Sandboxie (`SandboxieWUAU.exe`/`Start.exe` + malicious `sbiedll.dll`), plus other pairs (javaw.exe/jli.dll, Krita.exe/Krita.dll, Vmmap.exe/Version.dll, bginfo64.exe/snmpapi.dll, etc.). Sideloaded DLLs decode encrypted `config.ini` payloads into reflective, Metasploit-like stageless shellcode with custom API hashing and COFFLoader/BOF features. C2 patterns include file[.]io, gofile[.]io, ably[.]net/io, and GitHub raw configs; older builds used dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Post-compromise: `net` enumeration, `vssadmin` + ntds.dit theft. Victims in PH, TW, AF, NA, likely KR; UTC+8 activity hours.

1. EDR: legitimate signed Sandboxie/Java/Krita/Sysinternals binaries loading DLLs from unusual directories (user profile, temp, ProgramData).
2. File: `sbiedll.dll`, `config.ini` next to renamed Sandboxie loaders; ZIP droppers named like `aez.zip`.
3. Memory: reflective PE loaders / position-independent shellcode after a sideload; strings for host/user/GUID/domain telemetry.
4. Network: outbound to file-hosting/CDN and newly created GitHub repos (example in report: LatonyCharnleyaW) right after sideload.
5. AD: vssadmin shadow copy creation preceding ntds.dit access.

Full IOC list: SophosLabs GitHub (linked from the blog).

Sources: [Sophos: BRONZE SANDCASTLE deploys modified Meterpreter shells](https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells) · [Sophos threat profile: Bronze Sandcastle](https://www.sophos.com/en-us/threat-profiles/bronze-sandcastle)