He-Song Cui
He-Song Cui is an alias
that 5 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Narcass3 (@Narcass3) and Chollima Hunter.
The earliest of those reports is dated 2026-07-30 and the most recent 2026-09-24.
The reporting files it under the persona He-Song Cui, alongside 15 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.
x.com/Narcass3/status/2082696710174773638 — Narcass3 (@Narcass3) -
Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. The DEV Community account is the richest single page found for this operator: it presents as Ash Pala, joined 14 December 2021, claims "Full-stack developer with 7 years of experience since 2013" with Solidity and Hardhat among the skills, gives the location as Moscow, Russia, and publishes three of its own contact points — the address jsreputation@gmail.com, which this site already held, the GitHub account of the same name, and an about.me page under the slug urichoi. Both names it ties together, Ash Pala and Uri Choi, are names the reporting already files this operator under, which is what makes the page corroboration rather than a new lead. The dev.to account answers on the handle ashpala and on jsreputation, the older login. The GitLab account under jsreputation is a member since 11 March 2022 and states nothing but the display name "JS Reputation".
dev.to/ashpala — Chollima Hunter -
Found on 17 September 2026 by asking Keybase whether an account exists under ashpala, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 10 March 2023 and no display name but the handle itself. The profile carries a signed proof claiming the GitHub account jsreputation. A Keybase proof is a statement posted to the other account and signed by this one, so it evidences that whoever held this login also held that account at the time it was posted. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
keybase.io/ashpala — Chollima Hunter -
Found on 17 September 2026 by asking Docker Hub whether an account exists under ashpala, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 23 October 2017. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/ashpala — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/uripandada is account id 99074029, created on 5 February 2022, display name Ash Palania, location Russia. All 100 of its own commits in GitHub's search are signed uripandada@gmail.com, an address Narcass3 gives for He-Song Cui, and two commits in its repositories are signed jsreputation@gmail.com, another address the researcher gives for the persona. github.com/MachineLearningMike also commits heavily with an address on the same entry, fleetpro@gmail.com, but that address belongs to the paper co-author the researcher did not name as the worker, and that account is not filed.
github.com/uripandada — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.
Related indicators
Same persona record: He-Song Cui
All 15 on the He-Song Cui page
Cited by the same report: x.com/Narcass3/status/2082696710174773638
All 5 indicators from this source