BRONZE SANDCASTLE abuses legitimate Windows apps to load encrypted backdoors, collect system information and steal Active Directory data.

At a glance Malware family Custom Meterpreter-style backdoor (versions 1.1.5 and 1.1.7) Threat actor BRONZE SANDCASTLE; suspected China-based Targets Organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea Delivery vector DLL sideloading through Sandboxie and other trusted programs Key capabilities In-memory execution, host profiling, data theft, Active Directory database theft Source Sophos Counter Threat Unit and SophosLabs TL;DR…