Loading threat actor…
DeepSeek is a Chinese artificial intelligence company known for developing large language models, including R1. It has been publicly associated with intensive acquisition and use of Nvidia GPU infrastructure for AI model training and scaling. Reporting has linked the company to efforts to obtain large volumes of advanced Nvidia hardware despite U.S. export restrictions, including allegations of using intermediary entities and purported data-center fronts in Southeast Asia to evade compliance checks and move restricted systems into mainland China. These allegations center on export-control circumvention and hardware procurement rather than conventional cyber intrusion activity. DeepSeek has been described as relying on Nvidia hardware for advanced training workloads while also using domestic Chinese accelerators such as Huawei Ascend for some inference use cases. Its prominence in the U.S.-China AI competition has made it a recurring subject in discussions of sanctions evasion, supply-chain opacity, and the shadow market for restricted AI compute. No high-confidence evidence in the available material establishes DeepSeek as a traditional threat actor conducting network intrusions, malware operations, ransomware, or espionage campaigns. The strongest supported characterization is that of a Chinese AI firm alleged to have pursued restricted compute resources through export-control evasion mechanisms.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DeepSeek is accused of creating fake data centers in Southeast Asia to pass regulatory audits and then diverting Nvidia GPUs to China, circumventing export controls.
DeepSeek is allegedly involved in a sophisticated smuggling operation to illegally obtain and operate thousands of Nvidia Blackwell GPUs, circumventing U.S. export controls. The group reportedly uses fake data centers and shell companies to acquire and transport restricted hardware into mainland China for AI model training and development.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.