BRONZE SANDCASTLE deploys modified Meterpreter shells

The China-based threat group uses DLL sideloading in these attacks

Summary from Sophos News.