Cybersecurity & Data Protection
1
UPVOTE
thehackernews.com

China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
TN

The Hacker News

1h ago
1 0

Discussion

Your thoughts matter!

Your input is valuable—be the first to share it!

No comments yet.

Be the first to share your take and keep the conversation moving.

Join the conversation

Log in or sign up to add your comment and participate in the discussion!

Log In Sign Up

UPVOTERS

Community appreciation

See who found this content valuable and showed their support.

EM

Emma Klein

Emma KleinUpvoted 1h ago0 comments · 27 shares

TOPICS

Explore the same topics

Discover more content from the topics this post is mapped to.

thehackernews.com
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP …

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on…
LK

Lars Khan

32m ago
0
bleepingcomputer.com
Microsoft says October updates didn’t actually fix VPN issues

Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. [. .. ]
Nirano

Nirano

2h ago
0
bleepingcomputer.com
CISA: SafePay ransomware hit over 600 critical infrastructure o…

The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldw…
Carlos the great

Carlos the great

3h ago
0
schneier.com
Possible new Cellebrite iPhone Radio Zero-Day

Justin. sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to be co…
SS

Schneier on Security

17h ago
0
thehackernews.com
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthentic…

Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could…
SA

SariMartinez

18h ago
0
thehackernews.com
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes A…

The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised,  Mozilla and Google's Chrome Root Progra…
TN

The Hacker News

19h ago
0

Keep browsing

Explore more from this topic

Dive into the full feed of curated posts covering Cybersecurity & Data Protection.

Browse Topics

RELATED CONTENT

Continue exploring

Discover more content that aligns with your interests and this post.

thehackernews.com
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP …

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on…
LK

Lars Khan

32m ago
0
thehackernews.com
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthentic…

Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could…
SA

SariMartinez

18h ago
0
thehackernews.com
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes A…

The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised,  Mozilla and Google's Chrome Root Progra…
TN

The Hacker News

19h ago
0
thehackernews.com
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-…

An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 1…
TN

The Hacker News

1d ago
0
thehackernews.com
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoad…

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader.…
TN

The Hacker News

1d ago
0
thehackernews.com
GhostAction Attackers Plant Credential Stealer Disguised as Fon…

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish…
TN

The Hacker News

1d ago
0

Still curious?

See more related posts

Keep the inspiration flowing with fresh submissions and trending finds from the community.

View Latest