Source: Sophos CTU and SophosLabs: BRONZE SANDCASTLE deploys modified Meterpreter shells.

A legitimate Windows executable is not a verdict on everything it loads. Sophos researchers describe BRONZE SANDCASTLE using trusted programs to load malicious DLLs, decrypt local payload files and run a backdoor in memory. For small businesses and government contractors, the actionable issue is the relationship between the executable, its neighboring files and its subsequent behavior—not simply whether the executable has a familiar name.

What Sophos observed

Across investigated environments, legitimate Sandboxie executables appeared beside an attacker-controlled sbiedll.dll. Sophos also documented other executable-and-DLL combinations, including Java, Krita and Sysinternals utilities. The DLLs typically read encrypted payloads from config.ini files and execute the decoded code in memory. Renaming legitimate executables helps the activity blend into the environment.

The researchers describe a customized Meterpreter-based payload with loader behavior that differs from standard Metasploit output. This matters operationally: defenders should not assume that familiar open-source tooling will always produce an unchanged signature. Sophos also observed network and account enumeration, and instances of shadow-copy creation before copying the Active Directory database, ntds.dit.

Sophos attributes the cluster to a China-based group and reports victims in Asia and Africa in incidents spanning August 2025 to August 2026. It explicitly distinguishes BRONZE SANDCASTLE from other groups with overlapping geography. That reporting does not establish that U.S. government contractors were victims; the defensive value here is the documented technique.

Hunt the load chain, not the filename

Start with endpoint evidence that connects process execution, module loading and file access. Look for unusual copies of legitimate utilities in user-writable locations, adjacent DLLs that do not belong to the expected installation, and a process reading an unexpected configuration file before suspicious memory execution or outbound traffic. A config.ini filename by itself is not an indicator of compromise.

  • Baseline location and provenance. Compare executable paths, signer information, module paths and deployment records against known-good installations. A legitimate signer does not validate a neighboring DLL.
  • Correlate multiple signals. Prioritize combinations of an unexpected DLL load, local encrypted-file access, memory alerts and unusual child processes or network connections. Confirm which of these telemetry sources your EDR actually retains.
  • Preserve volatile evidence. When compromise is suspected, isolate affected endpoints through the incident-response process and have qualified responders capture relevant memory and endpoint artifacts before routine cleanup destroys evidence.
  • Escalate directory credential exposure. Investigate unexpected shadow-copy operations and access to ntds.dit, especially outside approved backup workflows. If directory credentials may have been stolen, removing one payload is not sufficient; assess identity scope and plan credential recovery with your directory-response team.

Legitimate services are context, not a clean bill of health

Sophos observed payload connections to legitimate hosting and communications services, possibly for command-and-control tasking, and GitHub activity associated with encrypted configuration downloads. Those observations do not make every connection to those services malicious. Correlate destinations with the initiating process, repository or account context, timing and business need. Broad blocking can disrupt legitimate work without proving containment.

Use the full indicator list linked from the Sophos report to enrich a hunt, but keep behavioral detection central. Indicators change; the executable-to-DLL-to-payload sequence is a more durable investigative starting point.

Bulwark Black assessment

For a lean security team, the highest-value next step is a focused validation exercise: can you reconstruct an unfamiliar utility's path, loaded modules, file reads and outbound traffic from retained telemetry? Document the answer, close visibility gaps and assign an escalation owner. For government contractors, preserve the investigation timeline and remediation evidence and assess any contractual reporting obligations against the facts of an actual incident—not the threat actor's name alone.

The practical lesson is simple: trust decisions belong to the execution chain. An authentic executable can still be the vehicle for hostile code.