Legitimate applications can load backdoors too: Sophos examines DLL sideloading
Sophos research found attackers placing malicious components beside legitimate applications so a backdoor loads when the application starts. A normal software name or digital signature is insufficient to establish that the entire execution process is safe.
Source Facts
Sophos published BRONZE SANDCASTLE research on 20 October, describing a legitimate Sandboxie program paired with a malicious DLL to load a backdoor. This DLL sideloading resembles a trusted worker bringing in an unverified component.
The research analyses events from August 2025 to August 2026 and says the backdoor can collect device and account information. Group naming and attribution are Sophos's assessments; the report does not allege that the official Sandboxie project itself distributes malware.
Sophos recommends checking for anomalous behaviour during program loading and in memory. A familiar filename or valid signature alone may not reveal whether a nearby component has been replaced.
Trusting an application's name does not mean every file downloaded with it is trustworthy.
Original sources
- BRONZE SANDCASTLE deploys modified Meterpreter shells ↗Published 2026.10.20
Reporting leads · The Hacker News
The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.
BRONZE SANDCASTLE deploys modified Meterpreter shells
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.