2026年10月23日の
セキュリティ情報

Subject: [Intel] DLL Sideloading Campaign by Bronze Sandcastle

Dear Team,

We are sharing intelligence regarding the threat actor Bronze Sandcastle.

■ Overview
The actor is employing DLL Sideloading techniques using legitimate applications such as Sandboxie, Java, Krita, NVDA, and Sysinternals tools. By loading a malicious DLL (e.g., sbiedll.dll), they deploy a Meterpreter-like backdoor in memory to avoid detection, enabling system reconnaissance, keylogging, and data exfiltration.

■ Scope
- Windows environments utilizing the aforementioned legitimate tools.
- Primarily targeting organizations in Asia and Africa.

■ Recommended Actions
1. Monitor for the execution of administrative tools (Sysinternals, etc.) from unusual or non-standard directories.
2. Audit for the presence of unexpected DLLs in application folders.
3. Monitor network traffic to common online services (e.g., GitHub) for potential C2 configuration downloads.

■ Reference
- Sophos Threat Intelligence

Priority: Medium
Deadline: Ongoing

Subject: [Security Alert] Caution Regarding Unauthorized App Permissions

Hi everyone,

We have observed an increase in attacks where adversaries trick users into granting access permissions (OAuth tokens) to malicious applications, bypassing MFA.

What we need from you:
1. If you encounter a request to "Allow" or "Authorize" an application that you did not intentionally initiate, do NOT approve it and report it to the IT team immediately.
2. Please review the list of third-party applications connected to your corporate account and revoke access for any that are no longer needed.

Deadline: End of today