Aiden Mori
Aiden Mori is an alias
that 7 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Narcass3 (@Narcass3) and Chollima Hunter.
The earliest of those reports is dated 2025-07-05 and the most recent 2026-09-29.
The reporting files it under the persona Aiden Mori, alongside 18 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
The post states the operator runs a project called DIFINES and that his initials may be KWH or CCI, and cites an analysis of IT-worker logs published by chollima-group.io alongside the accounts.
x.com/Narcass3/status/1941534049773981835 — Narcass3 (@Narcass3) -
Found on 17 September 2026 by asking Hugging Face whether an account exists under aiden77mori, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Aiden Mori. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
huggingface.co/aiden77mori — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- codeknight0707 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Lin Elliot. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/codeknight0707 — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- smartfox1203 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Roy Lee. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/smartfox1203 — Chollima Hunter -
Found on 18 September 2026 by putting smartfox1203, the GitLab login the index already holds for this persona, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. Freelancer returns the account with the display name Closed User and a registration date of 15 May 2022: an account existed under the handle and has since been closed, which is recorded here because a closed account is still a registration, and the date is the one fact it states. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
www.freelancer.com/u/smartfox1203 — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/0xdanieltran is account id 89995315, created on 2 September 2021, with 109 public repositories. Its noreply addresses name the handles aiden77mori and hellovlady, so it is the account Narcass3 names as github.com/aiden77mori under Aiden Mori, renamed; hellovlady is also a handle this index carries from other reporting, and both now return not found. Its repositories hold 82 commits signed aiden77mori@gmail.com and 3 signed smartfox1203@gmail.com, both addresses the researcher gives for the persona; its own commits are signed danillppiont106@gmail.com (83 of 100) and danieltran124@outlook.com (10), recorded here as the account's own.
github.com/0xdanieltran — Chollima Hunter -
Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (0xdanieltran, aiden77mori) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
github.com/0xdanieltran/0xdanieltran/blob/d7fc09f7c421737dd66df73a6bd746c8a3a0bda1/README.md — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.