China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Bronze Sandcastle abuses a well-known technique called DLL sideloading, placing malicious DLLs alongside trusted, signed applications (Sandboxie, Java, Krita) so the OS loads attacker code with the application's implicit trust. This works because many environments do not enforce strict controls over which DLLs legitimate processes are permitted to load, nor do they monitor for unexpected DLL origins or hashes. The use of legitimate file-sharing and messaging platforms for C2 further blends malicious traffic into normal network activity, making detection harder without deep inspection and behavioral analytics. This campaign matters because it demonstrates how adversaries can compromise systems without exploiting any software vulnerability — instead abusing trusted application mechanics — meaning traditional patch-centric defenses alone are insufficient.