BRONZE SANDCASTLE Hackers Steal Active Directory Database Using Hidden Windows Backdoors

BRONZE SANDCASTLE intrusions involving hidden Windows backdoors and the theft of the Active Directory database.

The suspected China-based group combines legitimate applications, malicious DLLs, and encrypted payloads to execute code inside trusted processes while limiting artifacts available to conventional file scanning.

Investigations covering August 2025 through August 2026 identified victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea.

Researchers assigned the activity a separate designation because its distinctive tooling could not be reliably attributed to other established threat groups.

The group’s strongest technical signature is repeated abuse of Sandboxie executables to load an attacker-controlled sbiedll.dll.

Operators place both files together, allowing the legitimate application to execute malicious code through sideloading.

MITRE tracks this execution-hijacking technique under T1574.001, describing how trusted applications can conceal encrypted payload execution.

Observed combinations include SandboxieWUAU.exe and renamed Start.exe loaders paired with sbiedll.dll. Other legitimate programs abused include Java, Krita, NVDA, LINE, and Microsoft Sysinternals utilities.

One recovered archive, aez.zip, contained javaw.exe, malicious jli.dll, and an encrypted config.ini payload.

The DLL typically reads config.ini, decodes its contents, and transfers execution into memory. Separating the encrypted payload from its loader also allows operators to change functionality without replacing the DLL.

Analysis revealed flattened control flow built around a virtualized state machine. Byte swapping, variable rotations, inversion, and negation transform state values into indirect jump-table destinations, complicating static reconstruction of the loader’s execution path.

Although structurally similar to stageless Metasploit payloads, its custom API hashing and greater complexity distinguish it from standard framework output.

BRONZE SANDCASTLE intrusions

The decoded payload contains a position-independent reflective loader that validates and loads an embedded executable directly into memory.

SophosLabs Researchers identified, elements associated with TrustedSec’s COFFLoader, suggesting support for custom Beacon Object File functionality.

Two observed backdoor versions, 1.1.5 and 1.1.7, transmit structured JSON containing hostnames, usernames, domain details, internal and public IP addresses, operating-system information, process metadata, architecture, and implant execution details.

COFFLoader itself provides mechanisms to load and execute BOFs without requiring a Cobalt Strike agent; code overlap therefore does not establish Cobalt Strike deployment.

Version 1.1.5 contacted dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Researchers also observed connections to file[.]io, gofile[.]io, ably[.]net, and ably[.]io, potentially for command-and-control tasking.

Version 1.1.7 retrieved encrypted configuration material through GitHub infrastructure associated with LatonyCharnleyaW.

Files masquerading as JavaScript source maps and README.md appeared to contain encrypted configurations, while encrypted .ts files potentially represented additional implants.

After deployment, operators executed Windows net commands to enumerate accounts and network resources.

They also created Volume Shadow Copies using vssadmin.exe before copying ntds.dit, the Active Directory database containing sensitive domain identity information.

Activity concentrated in UTC+8 working hours supports the researchers’ China-based attribution assessment.

Geographic overlap with BRONZE PRESIDENT and BRONZE ATLAS remains insufficient to establish shared operators.

Defenders should prioritize suspicious DLL loads, local configuration reads immediately preceding memory execution, reflective loading, and anomalous executable structures in memory.

Correlating those events with unexpected shadow-copy creation and database access can expose the attack sequence.

Application controls and module-load telemetry provide additional opportunities to identify trusted binaries loading malicious libraries from unusual directories.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.