Brian Young
Brian Young is an alias
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from GitLab Threat Intelligence.
The report is dated 2026-02-19.
The reporting files it under the persona Brian Young. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud RESEARCHER POST
Source
-
The persona of the operator in GitLab's fourth case study, a North Korean IT worker GitLab assesses was highly likely based in central Moscow when the photographs were taken on April 18, 2025, and who commonly reached GitLab.com from Russian IP addresses. The name appears only in the report's image of the operator's original and AI-enhanced photographs and the two profile pages that used them: a portfolio card reading "Brian Young, WebGL and Full Stack Developer" with a stated location of Kadoorie Hill, Hong Kong, and a "Meet the team" page captioned "Brian Young, Senior Full Stack Developer" with a LinkedIn icon. GitLab redacted both employers. GitLab reports that the operator began as a freelance developer and 3D modeler, was part of a 14-member cell in 2022, moved to seeking full-time employment at U.S. and U.K. organizations in 2025 through a facilitator in Hong Kong, presented as a Chinese national with visa difficulties to prospective facilitators, and gained employment with at least one small U.S. technology agency in mid-2025, with access to its client web hosts.
about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/ — GitLab Threat Intelligence
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.