China-Linked Hackers Turn Trusted Windows Applications Into Backdoors to Steal Credentials

China-linked hackers are using trusted Windows applications to load hidden backdoors, collect system details, and steal Active Directory credential data.

The group, tracked as BRONZE SANDCASTLE, places malicious files beside legitimate software, allowing familiar programs to run attacker-controlled code without changing the original application.

The campaign shows how genuine software can become part of an attack chain. Similar China-linked DLL sideloading attacks have abused trusted applications to hide malicious activity, although shared techniques alone do not establish a connection between threat groups.

Researchers from Sophos’ Counter Threat Unit and SophosLabs identified the malware while investigating incidents across Asia and Africa.

Their technical report on the campaign, published October 20, describes attacks observed between August 2025 and August 2026 involving victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea.

China-Linked Hackers Turn Trusted Windows Applications

Sandboxie DLL sideloading is the group’s clearest technical marker. Attackers placed legitimate Sandboxie programs beside a malicious supporting library.

When launched, the trusted application loaded that library and handed execution to the attackers. The report also documents abused components from Java, Krita, NVDA, LINE, and Microsoft Sysinternals.

The malicious libraries typically read an encrypted payload from a local configuration file, decode it, and execute code in memory.

This separates the visible application from the hidden backdoor and lets operators change payload behavior without replacing the loading library. Renamed executables further help the files blend into compromised systems.

Other ShadowPad DLL sideloading campaigns have used a comparable three-part structure: a legitimate program, a malicious library, and an encrypted payload.

That similarity provides useful context, but Sophos tracks BRONZE SANDCASTLE separately because its observed activity could not be reliably linked to BRONZE PRESIDENT or BRONZE ATLAS.

Modified Meterpreter Payload Steals System Data

The decoded backdoor uses a reflective loader, which places an embedded Windows program into memory. Although its structure resembles Metasploit shellcode, Sophos found custom function-resolution routines and a larger, more complex codebase than standard examples. Elements of COFFLoader also suggest custom features for use after a system is compromised.

Researchers identified payload versions 1.1.5 and 1.1.7. The backdoor sends its control server a structured JSON message containing computer and user names, domain details, operating system version, internal and public IP addresses, process information, working directory, processor type, and startup time.

Version 1.1.5 contacted dedicated control domains, while version 1.1.7 downloaded encrypted configuration files through GitHub.

Connections to legitimate file-sharing and messaging services may also have supported operator instructions, although Sophos did not confirm that purpose.

After gaining access, the operators used Windows network commands to inspect accounts and local networks. They also created Volume Shadow Copies before copying the Active Directory database.

This activity connects the backdoor’s remote access with attempts to obtain sensitive domain credential data. Previous Windows shadow copy abuse shows why this sequence matters: snapshots can expose protected database contents.

Sophos recommends detecting libraries that read local files and immediately execute code in memory, alongside unusual executable headers and reflective loading. Behavior and memory monitoring are important because encrypted payloads can weaken static file detection.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post China-Linked Hackers Turn Trusted Windows Applications Into Backdoors to Steal Credentials appeared first on Cyber Security News.