BRONZE SANDCASTLE Hackers Abuse Sandboxie to Load Encrypted Backdoors

Security researchers at Sophos have identified a campaign by the China-based threat group BRONZE SANDCASTLE that leverages legitimate Windows applications to install malicious software on target systems. The group uses these trusted programs to load encrypted backdoors, allowing them to operate within compromised environments.

According to a report by Hackread, the attackers specifically abuse Sandboxie, a well-known sandboxing application, to facilitate the loading of these backdoors. This technique involves using a legitimate application to deliver the malicious payload. The backdoors themselves are encrypted, which is a characteristic noted by the researchers in their analysis of the group's tools.

Operational Tactics and Capabilities

The primary objective of these backdoors, as noted by Sophos, is to collect detailed system information from the infected machines. This data gathering provides the attackers with information about the internal network architecture and security posture. By collecting this intelligence, BRONZE SANDCASTLE can potentially plan further actions within the compromised organization.

In addition to system data, the group targets Active Directory information. The source material indicates that the attackers steal Active Directory data, which is critical for managing user identities and access permissions in Windows environments. This type of data is often a target for threat actors seeking deeper access to corporate networks.

Attribution and Background

The threat actor behind this activity is identified as BRONZE SANDCASTLE, a group described in the source material as China-based. This attribution places the group within a specific geopolitical context, consistent with previous reports on similar activities. The use of sophisticated techniques such as abusing legitimate applications and encrypting payloads suggests a mature operation.

Sophos, the cybersecurity firm that discovered and analyzed this campaign, highlighted the use of Sandboxie as a key indicator of compromise. The group’s reliance on this specific application for loading backdoors provides a distinct signature for security teams to monitor.

What should you do?

Security professionals should review logs for unusual activity related to Sandboxie and other legitimate Windows applications. Monitoring for unexpected connections or data collection attempts can help identify compromised systems. Organizations should also ensure that their endpoint detection and response tools are configured to alert on anomalous behavior, even from trusted applications.

Background: Endpoint detection and response (EDR)

Endpoint detection and response examples include blocking PowerShell scripts that download payloads, isolating devices showing abnormal memory access, and rolling back file changes. These tools monitor behavior, not just signatures, to stop advanced threats that evade standard security controls.

Read the full guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

What to do and how to stay safe: BRONZE SANDCASTLE

• Monitor for unusual process executions involving Sandboxie or other sandboxing tools.
• Review network logs for encrypted traffic originating from workstations that may indicate backdoor communication.
• Audit Active Directory access logs to detect unauthorized data retrieval attempts.
• Ensure endpoint security solutions are updated to detect known indicators of compromise associated with BRONZE SANDCASTLE.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What group is responsible for this abuse of Sandboxie?

The China-based threat group BRONZE SANDCASTLE is responsible for abusing Sandboxie to load encrypted backdoors.

What data are the attackers collecting?

The attackers are collecting system information and stealing Active Directory data from compromised systems.

How are the backdoors loaded?

The backdoors are loaded by abusing legitimate Windows applications, specifically Sandboxie, according to findings by Sophos.