Bronze Sandcastle

Adversary

Hunt only

(Sophos (https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells), A/3) — sideloading pairs (legitimate executable + malicious DLL): SandboxieWUAU.exe / Start.exe (renamed Sandboxie) with sbiedll.dll; javaw.exe with jli.dll; Krita.exe with Krita.dll; NvdaHelper.exe with NvdaHelperRemote.dll; Jcef_helper.exe with Libcef.dll; Vmmap.exe with Version.dll; LineAppMgr.exe with msvcp140.dll; bginfo64.exe with snmpapi.dll. Staging archive aez.zip (clean javaw.exe + jli.dll + encrypted config.ini). Payload versions 1.1.5 (C2 dc[.]cathaypacifice[.]com, net[.]dpworldto[.]com) and 1.1.7 (encrypted configs fetched from GitHub repository api[.]github[.]com/repos/LatonyCharnleyaW — main.3ku8inqb.js.map, main.lhxjkkai.js.map, main.y8hnze7q.js.map, README.md, plus .ts files that may be implants). Legitimate-service outreach: file[.]io, gofile[.]io, ably[.]net, ably[.]io. The primary states the full indicator list is available in a SophosLabs GitHub repository (no URL given on the page). Assessed 2026-10-24, hunt-only — the C2 domains and the GitHub repository are perishable operator infrastructure; the durable hunt value is behavioral: the nine sideloading file pairs, the config.ini read-then-execute pattern, and the shadow-copy ntds.dit copy sequence.

Detailed

Sideloading pairs (legitimate file → sideloaded malicious DLL): SandboxieWUAU.exe → sbiedll.dll; Start.exe (renamed Sandboxie) → sbiedll.dll; javaw.exe → jli.dll; Krita.exe → Krita.dll; NvdaHelper.exe → NvdaHelperRemote.dll; Jcef_helper.exe → Libcef.dll; Vmmap.exe → Version.dll; LineAppMgr.exe → msvcp140.dll; bginfo64.exe → snmpapi.dll. Staging archive: aez.zip (clean javaw.exe + jli.dll + encrypted config.ini). Payload versions: 1.1.5 (C2: dc[.]cathaypacifice[.]com, net[.]dpworldto[.]com) and 1.1.7 (GitHub config retrieval: hxxps://api[.]github[.]com/repos/LatonyCharnleyaW — files main.3ku8inqb.js.map, main.lhxjkkai.js.map, main.y8hnze7q.js.map, README.md, plus .ts-extension files that may be implants). Legitimate-service outreach: file[.]io, gofile[.]io, ably[.]net, ably[.]io. Beacon structure: JSON with nested info block — hostname, username, GUID, domain, OS version (e.g. 10.0.19042), internal and public IPs, process listing (PID, name, execution method), working directory, code page, CPU architecture, implant start time, implant type (server/client). Post-exploitation: net commands (network/user enumeration), vssadmin.exe shadow-copy creation, ntds.dit copy. Loader internals per the primary: position-independent PE loader and execution stub (reflective loader), flattened control-flow dispatcher (virtualized state machine). The primary states the full IOC list is in a SophosLabs GitHub repository (no URL given on the page). Campaign window: incidents August 2025 through August 2026. All from the primary (Sophos (https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells), A/3).