Spencer Duncan
Spencer Duncan is an alias
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from ZEUS-DEV-919 working document and Chollima Hunter.
The reports are dated 2026-09-21.
The reporting files it under the persona Spencer Duncan, alongside 5 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used.
docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document -
Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
github.com/everythinguwannatobe — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.