Verify Active Directory Integrity After BRONZE SANDCASTLE Intrusions

Organizations that rely on Windows-based Active Directory infrastructure face exposure to credential theft by the BRONZE SANDCASTLE threat group. According to GBHackers, this suspected China-based group targeted entities in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea between August 2025 and August 2026. The primary objective was stealing the Active Directory database, which contains sensitive user credentials and access rights.

Root cause

The intrusion relied on abusing legitimate Windows applications to execute malicious code while avoiding detection by conventional file scanning. Operators combined trusted executables with malicious dynamic-link libraries and encrypted payloads. This technique allowed the group to run code inside processes that security tools typically trust. Researchers noted that this approach limited the digital artifacts available for analysis, making the intrusion harder to detect through standard means.

Attack path

The group’s strongest technical signature involved repeated abuse of Sandboxie executables to load an attacker-controlled sbiedll.dll. According to GBHackers, operators placed both files together, enabling the legitimate application to execute malicious code through sideloading. MITRE tracks this execution-hijacking technique under T1574.001. Observed combinations included SandboxieWUAU.exe and renamed Start.exe loaders paired with the malicious DLL. Other abused programs included Java, Krita, NVDA, LINE, and Microsoft Sysinternals utilities.

Affected versions

The source material does not specify particular version numbers of the abused software that are vulnerable. The attacks targeted installations of legitimate applications that could be manipulated to load external libraries. This includes Sandboxie, Java, and other common Windows utilities. The threat actors exploited the inherent trust these applications hold within the operating system environment, rather than a specific coding error in a single version.

Mitigation

• Monitor for unexpected DLL loading by trusted applications, particularly Sandboxie and Java.
• Inspect directories containing legitimate executables for accompanying malicious DLLs like sbiedll.dll.
• Review network traffic for signs of encrypted payload execution and memory-based loading.
• Validate the integrity of Active Directory databases for unauthorized access or exfiltration.

For customers and users

Teams should verify whether their Active Directory credentials have been compromised. Check for unusual logins or permission changes in user accounts. Look for legitimate applications running with unexpected dependencies or in unusual directories. Be alert for follow-up phishing emails that reference this breach to trick employees into revealing new passwords. Organizations should assume that any stolen directory data may be used for further lateral movement or identity theft attempts.

Background: Threat actors

A threat actor is any individual or group that initiates a security incident. The term distinguishes the person or organization behind the attack from the technical method used. Analysts use this classification to predict future behavior and tailor defenses based on the actor’s goals rather than just their tools.

Read the full guide: Threat Actors Defined: Who They Are and How They Operate

What to do and how to stay safe: BRONZE SANDCASTLE

• Audit your Active Directory logs for unauthorized access attempts during the August 2025 to August 2026 window.
• Scan endpoints for legitimate executables paired with unexpected DLLs, especially sbiedll.dll or jli.dll.
• Reset passwords for any accounts that had administrative access to directory services during the intrusion period.
• Review firewall logs for outbound connections that match the profile of encrypted payload exfiltration.

Step-by-step guide: Unauthorized Access Prevention Checklist for Systems

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which countries were affected by the BRONZE SANDCASTLE intrusions?

Victims were identified in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea.

What technique did the group use to hide their malicious code?

They used DLL sideloading, placing malicious libraries alongside legitimate applications like Sandboxie and Java.

Did the group use any specific tools or loaders?

They used a position-independent reflective loader and elements associated with TrustedSec’s COFFLoader.