{"id":228240,"date":"2024-09-26T09:30:00","date_gmt":"2024-09-26T07:30:00","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=228240"},"modified":"2026-01-09T14:09:27","modified_gmt":"2026-01-09T14:09:27","slug":"a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/","title":{"rendered":"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"228240\" class=\"elementor elementor-228240\" data-elementor-settings=\"{&quot;element_pack_global_tooltip_width&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_padding&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true}}\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-43af391b e-flex e-con-boxed e-con e-parent\" data-id=\"43af391b\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5b12370e elementor-widget elementor-widget-text-editor\" data-id=\"5b12370e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h4>Key findings<\/h4><p>\u00a0<\/p><ul><li>The online presence of \u201call_father\u201d, the user advertising PandorahVNC.<\/li><li>The capabilities of PandorahVNC and other known threat actors that were observed using it.<\/li><li>An infrastructure related to PandorahVNC which is advertised as \u201canonvnc\u201d and is linked with the remote tool Mesh Central.<\/li><\/ul><h4>\u00a0<\/h4><h4>\u00a0<\/h4><h4>Introduction<\/h4><p>\u00a0<\/p><p>Hidden Virtual Network Computing (HVNC) is a sophisticated form of remote access designed for stealthy control over an infected system. Unlike traditional VNC tools, HVNC operates covertly, ensuring that the infected user&#039;s desktop environment remains unchanged and unsuspecting while the attacker manipulates a hidden desktop session.<\/p><p><br \/>HVNC malware is often employed in targeted attacks and is favored for its ability to bypass traditional security measures. It enables attackers to remotely control the compromised machine, perform financial transactions, or access sensitive information without being detected by the victim. The use of HVNC has been associated with various cybercrime campaigns, particularly those targeting financial<br \/>institutions and enterprises.<\/p><p>For this analysis, we will delve into the capabilities of PandorahVNC, exploring its infection vectors, infrastructure, and the implications of its deployment in the current threat landscape. We will also focus on an infrastructure linked with PandorahVNC that is currently being built to advertise a tool named \u201canonvnc\u201d, related to MeshCentral remote session manager. By understanding the mechanisms and impact of these malware, cybersecurity professionals can better prepare defenses and mitigate the risks associated with them.<\/p><p>On March 10, 2022, Florian Roth (@cyb3rops on X) made a tweet about PandorahVNC, exposing the content of one of its websites and asking his audience if this is \u201cmalware or legitimate software that has the same features and functions as malware?\u201d. An OSINT investigation on PandorahVNC&#039;s operator was made by SlashNext on 13 December 2023, but since we did not identify a complete analysis of this operator and its tool, we decided to start an investigation on this subject.<\/p><h4>\u00a0<\/h4><h4>Intrinsec&#039;s CTI services<\/h4><p>\u00a0<\/p><p>Organizations are facing a rise in the sophistication of threat actors and intrusion sets. To address these evolving threats, it is now necessary to take a proactive approach in the detection and analysis of any element deemed malicious. Such a hands-on approach allows companies to anticipate, or at least react as quickly as possible to the compromises they face.<\/p><p>For this report, shared with our clients in July 2023, Intrinsec relied on its Cyber Threat Intelligence service, which provides its customers with high value-added, contextualized and actionable intelligence to understand and contain cyber threats. Our CTI team consolidates data &amp; information gathered from our security monitoring services (SOC, MDR, etc.), our incident response team (CERT-Intrinsec) and custom cyber intelligence generated by our analysts using custom heuristics, honeypots, hunting, reverse-engineering &amp; pivots.<\/p><p>Intrinsec also offers various services around Cyber Threat Intelligence:<\/p><ul><li>Risk anticipation: which can be leveraged to continuously adapt the detection &amp; response capabilities of our clients&#039; existing tools (EDR, XDR, SIEM, \u2026) through:<ul><li style=\"list-style-type: none;\"><ul><li><strong>an operational feed of IOCs based on our exclusive activities.<\/strong><\/li><li><strong>threat intel notes &amp; reports, TIP-compliant.<\/strong><\/li><\/ul><\/li><\/ul><\/li><li>Digital risk monitoring:<ul><li style=\"list-style-type: none;\"><ul><li><strong>data leak detection &amp; remediation<\/strong><\/li><li><strong>external asset security monitoring (EASM)<\/strong><\/li><li><strong>brand protection<\/strong><\/li><\/ul><\/li><\/ul><\/li><\/ul><p>For more information, go to <a href=\"http:\/\/www.intrinsec.com\/en\/cyber-threat-intelligence\/\">intrinsec.com\/en\/cyber-threat-intelligence\/<\/a>.<\/p><p>Follow us on <a href=\"https:\/\/www.linkedin.com\/company\/intrinsec\/\">LinkedIn<\/a> and <a href=\"https:\/\/twitter.com\/Intrinsec\">X<\/a><\/p><p class=\"wp-block-paragraph\">\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e7dd65d e-flex e-con-boxed e-con e-parent\" data-id=\"e7dd65d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-072d5a1 elementor-widget elementor-widget-button\" data-id=\"072d5a1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/01\/TLP-CLEAR-20240925-PandorahVNC-and-MeshCentral-EN.pdf\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Download the full report content<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Key findings \u00a0 The online presence of \u201call_father\u201d, the user advertising PandorahVNC. The capabilities of [&hellip;]<\/p>\n","protected":false},"author":43,"featured_media":231215,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,11],"tags":[62],"class_list":["post-228240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-threat-intelligence","category-threat-intelligence-report","tag-cyber-threat-intelligence-en"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.0 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>A stalker in the box: infrastructure linking PandorahVNC and Mesh Central - INTRINSEC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central\" \/>\n<meta property=\"og:description\" content=\"Key findings \u00a0 The online presence of \u201call_father\u201d, the user advertising PandorahVNC. The capabilities of [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2024-09-26T07:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-09T14:09:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/01\/CTI_REPORT_Pandorahvnc_cover.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1414\" \/>\n\t<meta property=\"og:image:height\" content=\"2000\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ruben Madar\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ruben Madar\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/\"},\"author\":{\"name\":\"Ruben Madar\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8656db17eff6a4f9a372f5dd5bd08853\"},\"headline\":\"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central\",\"datePublished\":\"2024-09-26T07:30:00+00:00\",\"dateModified\":\"2026-01-09T14:09:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/\"},\"wordCount\":532,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/CTI_REPORT_Pandorahvnc_cover.png\",\"keywords\":[\"Cyber Threat Intelligence\"],\"articleSection\":[\"Cyber Threat Intelligence\",\"Threat Intelligence Report\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/\",\"name\":\"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/CTI_REPORT_Pandorahvnc_cover.png\",\"datePublished\":\"2024-09-26T07:30:00+00:00\",\"dateModified\":\"2026-01-09T14:09:27+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/CTI_REPORT_Pandorahvnc_cover.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/CTI_REPORT_Pandorahvnc_cover.png\",\"width\":1414,\"height\":2000},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8656db17eff6a4f9a372f5dd5bd08853\",\"name\":\"Ruben Madar\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g\",\"caption\":\"Ruben Madar\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/ruben-madar\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central - INTRINSEC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/","og_locale":"en_US","og_type":"article","og_title":"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central","og_description":"Key findings \u00a0 The online presence of \u201call_father\u201d, the user advertising PandorahVNC. The capabilities of [&hellip;]","og_url":"https:\/\/www.intrinsec.com\/en\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/","og_site_name":"INTRINSEC","article_published_time":"2024-09-26T07:30:00+00:00","article_modified_time":"2026-01-09T14:09:27+00:00","og_image":[{"width":1414,"height":2000,"url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/01\/CTI_REPORT_Pandorahvnc_cover.png","type":"image\/png"}],"author":"Ruben Madar","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Ruben Madar","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/"},"author":{"name":"Ruben Madar","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8656db17eff6a4f9a372f5dd5bd08853"},"headline":"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central","datePublished":"2024-09-26T07:30:00+00:00","dateModified":"2026-01-09T14:09:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/"},"wordCount":532,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/01\/CTI_REPORT_Pandorahvnc_cover.png","keywords":["Cyber Threat Intelligence"],"articleSection":["Cyber Threat Intelligence","Threat Intelligence Report"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/","url":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/","name":"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/01\/CTI_REPORT_Pandorahvnc_cover.png","datePublished":"2024-09-26T07:30:00+00:00","dateModified":"2026-01-09T14:09:27+00:00","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/#primaryimage","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/01\/CTI_REPORT_Pandorahvnc_cover.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/01\/CTI_REPORT_Pandorahvnc_cover.png","width":1414,"height":2000},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/a-stalker-in-the-box-infrastructure-linking-pandorahvnc-and-mesh-central\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"A stalker in the box: infrastructure linking PandorahVNC and Mesh Central"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8656db17eff6a4f9a372f5dd5bd08853","name":"Ruben Madar","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g","caption":"Ruben Madar"},"url":"https:\/\/www.intrinsec.com\/en\/author\/ruben-madar\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/228240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=228240"}],"version-history":[{"count":5,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/228240\/revisions"}],"predecessor-version":[{"id":231219,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/228240\/revisions\/231219"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media\/231215"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=228240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=228240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=228240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}