Jaron Gaston
Jaron Gaston is an alias
that 4 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer), Cookie Connoisseur (@browsercookies), Heiner García and Chollima Hunter.
The earliest of those reports is dated 2025-04-19 and the most recent 2025-06-24.
The reporting files it under the persona Jaron Gaston, alongside 5 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
One post listing three names together with a single pool of addresses, phone numbers, accounts and portfolio sites, under the heading the researcher gives it. The post does not say which value belongs to which name, and it does not say the three are one operator, so only the values that name a person themselves are attributed. Everything else is recorded as a group. Independently, Group-IB's research on a reusable persona shell it tracks as cybersage14 names Dejan-Teofilovic as an identity that account shifted to, and the GitHub account under that name was already indexed from that report; this post is a second, separate citation for it.
x.com/meow_mfer/status/1929659508428886218 — meow mfer (@meow_mfer) -
The GitHub account is read by hand from the third attached screenshot, a profile page headed Awesome with the handle 7CodeWizard, 73 repositories and 1.2k followers, and from a second capture of a bare profile card reading Jaron Gaston with no followers. This entry is browsercookies writing about the same name meow_mfer wrote about separately in June 2025. The two citations are independent, and the site groups them under one persona because they name the same identity.
x.com/browsercookies/status/1913730114661372362 — Cookie Connoisseur (@browsercookies) -
The Calendly page Heiner García's report of 24 June 2025 gives for the 7CodeWizard account.
www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html — Heiner García -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under 7codewizard, a login the index already carries for this persona on another platform. It gives a joined date of Jul 9, 2024. It displays the name Jaron Gaston, the same name the reporting already gives. It gives a location of Murphysboro, IL, USA. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/7codewizard — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.
Related indicators
Same persona record: Jaron Gaston
Cited by the same report: x.com/meow_mfer/status/1929659508428886218
All 15 indicators from this source