Sophos researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading. https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells