Chae Gwang Jin
Chae Gwang Jin is an alias
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies) and Chollima Hunter.
The earliest of those reports is dated 2025-07-23 and the most recent 2025-09-26.
The reporting files it under the persona Chae Gwang Jin, alongside 9 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
- x.com/browsercookies/status/1947820856459330016 — Cookie Connoisseur (@browsercookies)
-
Read on 21 September 2026 from the repositories of the GitHub account the cited post attributes to this persona, Guangyang-Sunlight. Two of them, Ronel_Resume and Software_AI-ML-_Engineer, were created on 26 September 2025 and hold between them three commits, every one signed Business_DEV <vpn001942@gmail.com> and attributed by GitHub to a second account, Business-Senior-Dev, created on 10 September 2025 with the bio "Perfect and Clean Code." and that address as its public profile email. The first commit to Ronel_Resume is timestamped 39 seconds before the repository itself was created, and the repository was created under Guangyang-Sunlight: whoever was signed in as this persona to create it pushed to it, within the minute, from a working copy configured with the second account's identity, which is one person at one keyboard rather than a contributor. The repository holds a curriculum vitae as a PDF and the source of a site built with a page generator that deployed it to ronel-resume.vercel.app, since taken down. The CV is transcribed on this page. It presents a senior software engineer in Calapan in the Philippines with a LinkedIn address that no longer resolves; the name and the details on it may belong to a real person whose document was taken, and nothing here settles that. Business-Senior-Dev's other repository is the same page-generator build of a Madrid SEO agency's site that Software_AI-ML-_Engineer holds, so both accounts carry the same client work. One further observation is recorded here and is not an indicator: on 12 September 2025 this persona created three repositories for a voice-assistant backend named Assistmind, Business-Senior-Dev created an empty repository of the same name the same day, and on 19 September 2025 miracle709, the account this site files under Taro Aikuchi, created a repository holding 189 files byte for byte identical to the backend. Nine unrelated accounts also hold repositories of that name, so the project was evidently handed to several developers at once; the shared files say the two personas were given the same code, not that they are one hand.
github.com/Guangyang-Sunlight/Ronel_Resume — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.
Related indicators
Same persona record: Chae Gwang Jin
All 9 on the Chae Gwang Jin page