Chollima Hunter

← Remote Workers

https://calendly.com/7codewizard

https://calendly.com/7codewizard is a Calendly account that 3 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Heiner García, ANY.RUN, North Scan and ketman.org. The earliest of those reports is dated 2025-06-24 and the most recent 2026-10-18.

The reporting files it under the persona Jaron Gaston, alongside 5 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

calendly account IT Worker Fraud MATCHED IN SOURCE

Listed as 7codewizard

First seen 2025-06-24 · last seen 2026-10-18

Sources

  • The Calendly page Heiner García's report of 24 June 2025 gives for the 7CodeWizard account.
    www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html — Heiner García · under “Jaron Gaston” · published 2025-06-24 · pulled 2026-09-29

  • Nearby text:

    …URL:https://github.com/neymafullstack URL:https://github.com/swiftcode1121 URL:https://github.com/ghost URL:https://calendly.com/7codewizard/30min URL:https://jackson-portfolio.vercel.app URL:https://www.linkedin.com/in/jackson-kidd-1680b2339/…
    How We Caught Lazarus's IT Workers Scheme Live on Camera — ANY.RUN · under “About ANY.RUN” · published 2025-12-04 · pulled 2026-09-27
  • …The notable difference is that this second message includes a Calendly scheduling link: https://calendly.com/7codewizard/30min - instructing the recipient to schedule a meeting Figure 24: Calendly 7codewizard already reported:…
    The GitHub Diaries of DPRK IT Workers — North Scan · under “6.1 GitHub account "ghost" DPRK IT Worker - recruiter” · pulled 2026-09-27

  • Nearby text:

    …Email Addresses: truepartner312@gmail.com motosimasuo@gmail.com jacksummers0822@gmail.com Calendly url: https://calendly.com/7codewizard/30min https://calendly.com/davidcolman002/30min Wallet Address: 14iULn6TYRmawsxazqR2xwWVuyDXc8ycGjg7ppJ15qVKctEN (Used in the…
    Understanding DPRK IT Worker Activity - Conversations and Insights - Ketman - Threat intelligence for remote and open source organizations — ketman.org · under “8.3 Indicators of Compromise (IOCs)” · published 2025-06-24 · pulled 2026-09-27

Find this indicator in the index, or see every Calendly account this site holds under Calendly accounts in the browse listing.

Related indicators

Same persona record: Jaron Gaston

Other identifiers the reporting files under the same persona.

Cited by the same report: www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html

Heiner García lists 14 other indicators in this source. 3 are shown, chosen across types.

All 15 indicators from this source

Cited by the same report: How We Caught Lazarus's IT Workers Scheme Live on Camera

ANY.RUN lists 9 other indicators in this source. 2 are shown, chosen across types.

All 10 indicators from this source

Cited by the same report: The GitHub Diaries of DPRK IT Workers

North Scan lists 27 other indicators in this source. 2 are shown, chosen across types.

All 28 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.