I was logged into a Debian 10 system this morning and was looking to see if an Areca console was running. Noticed "init" listening on port 111 where RPC used to be. Seems like a dangerous move but at this point, not surprised.

tcp6       0      0 :::111                  :::*                    LISTEN      0          21844      1/init               off (0.00/0/0)
udp        0      0 0.0.0.0:111             0.0.0.0:*                           0          17610      1/init               off (0.00/0/0)
udp6       0      0 :::111                  :::*                                0          18911      1/init               off (0.00/0/0)