DeepAudit

Reported Context (1)

Figure 02: Hunt.io IP profile for 112.213.124[.]132 showing open ports 1111, 3000 (DeepAudit), 5003 (ARL), 8084 (Vshell), and 8888 (open directory).The following ports and services were running on the server at the time Hunt.io Details Suspected China-Linked Campaign Using Claude Code and DeepSeek Against Government Systems

Malware (2)

MITRE ATT&CK (7)

Vendors (5)

Products (6)

Tools (6)

Industries (7)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.