Bronze Sandcastle has targeted organizations in Asia and Africa since mid-2025, using DLL sideloading to load malicious files through legitimate programs such as Sandboxie.
The reporting identifies additional programs used in the activity, two payload versions, and a backdoor that can collect keystrokes and screenshots.
The group is reportedly linked to activity originating from China.
How they bypass security measures
Attackers use legitimate programs to upload dangerous files and try to bypass security measures.
They have used Sandboxie, as well as programs like Java, Krita, and NVDA, as well as tools from Sysinternals.
What does the dangerous file do?
The file gives attackers covert access and collects what the user types, as well as screenshots.
READ ALSO
New protection in Chrome blocks scams that steal data through code copying
The configuration files are encrypted and the program only reads them when it is running. The team has also used platforms like GitHub to download additional configuration files.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)