Chollima Hunter

← Remote Workers

https://github.com/kasparexzi

https://github.com/kasparexzi is a GitHub account that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The earliest of those reports is dated 2025-02-27 and the most recent 2026-10-03.

The reporting files it under the persona Kaspar Kruus, alongside 19 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud CURATED live checked 2026-10-11

First seen 2025-02-27 · last seen 2026-10-03

Sources

  • Read on 3 October 2026 from GitHub commit histories. Commits authored under the name Kaspar Kruus, a name a researcher published in August 2025 as an alias of one operator, come from four accounts: marvynpingul (account ID 165824649, formerly logged in as petermantop, which its own private commit address still names) at petermantop@gmail.com; Kasparexzi at kaspar@exzi.com; kaspar-atrnous at kaspar.kruus@atronous.ai, which pushed a repository named veriff-face-api in May 2025; and Kaspar-Kruus99 at kasparkruus99@outlook.com. From May 2026 the same petermantop@gmail.com mailbox signs its commits Marvyn Pingul. The accounts and the full network around them are set out in the candidate entry kaspar-kruus.
    github.com/marvynpingul/CryptoRealTimePrice/commits — Chollima Hunter · under “Kaspar Kruus” · published 2025-02-27 · pulled 2026-10-03
  • Confirmed by Chollima Hunter research and rated high confidence; corroborated by Post listing Kaspar Kruus among the other personas of one operator, browsercookies on X. The name Kaspar Kruus is already in this site's index as one of seven aliases a researcher posted on 2 August 2025 as other personas of a single operator, alongside Ervin Halmi, Timur Sarv, Balasz Ballo, Gerson Stuva, Boudewijn Geiger and Oskar Teder. Chollima Hunter research then found the accounts filed here, all read on 3 October 2026. The profiles. torre.ai presents a senior full-stack developer in Tallinn, Estonia, working since 2014, at SENLA from 2022 to 2024 and Ronasit from 2015 to 2018, with a Central Arizona College degree. The Freelancer.com account kaspar033 shows Kaspar K., joined 7 March 2025, a principal full-stack engineer with more than ten years of experience, placed in the Philippines rather than Estonia. Both LinkedIn accounts the research recorded are now removed; kaspar-kruus-0982802b9 was already gone, and kaspar-kruus-aab966366 returned LinkedIn's not-found page on 3 October 2026. The GitHub account. The research gave github.com/petermantop, which no longer resolves under that login. It was renamed rather than deleted: a commit in veriff-face-api is authored as Kaspar KK under 165824649+petermantop@users.noreply.github.com, and 165824649 is the account ID of marvynpingul, created 2 April 2024 with the display name Marvyn. Under that account petermantop@gmail.com commits as petermantop, peter, kaspar, Kaspar and Kaspar Kruus from April 2024 to March 2026 (ai-pm-api, Crypto-OrderBook-Desk, CryptoRealTimePrice, DailyWordArticle, sku-frontend, sku-management-api, trading-settlement), and from May 2026 as Marvyn Pingul (nifi-flow-test): the same mailbox moving from this persona to a new name. CryptoRealTimePrice also carries a commit by Kaspar Kruus at kaspar@exzi.com, linked to the account Kasparexzi (created 11 November 2024, empty); Exzi is a cryptocurrency exchange. veriff-face-api, a repository named for an identity-verification provider's face check, was pushed on 20 May 2025 in ten commits by Kaspar Kruus at kaspar.kruus@atronous.ai, linked to kaspar-atrnous (created 1 April 2025, empty), the address that also signs a 2026 commit in Kaspar-Kruus99/LifeLedger. Kaspar-Kruus99 (created 3 April 2025, display name Kaspar) commits as kasparkruus99@outlook.com. Further accounts under the name are Kaspar-Kruus (January 2025), kaspar-kruus032 (March 2025) and DanielLeeDevMaster (June 2025, display name Kaspar Kruus, bio "Hello, I am a Senior Software Engineer."). The network. Kaspar-Kruus follows exactly two accounts, bartlomiej-629 (Bartlomiej Czeslaw Jakubowicz, BartlomiejCzeslaw@outlook.com) and bernardus-425 (Bernardus Besseler, bernardus.besseler@outlook.com), created five minutes apart on 5 February 2025. They hold the same set of about 27 projects each, created on the same days (an AI project-management API, a bank app, a hotel system, a rental platform, a Web3 message signer and others), and two of those projects also exist under marvynpingul. Both are followed by JamesWBeck (created March 2024, empty), which follows nothing else. A co-author on marvynpingul/ai-pm-api, memokey (skytopground@gmail.com, an account from 2022), is recorded as where those commits sit and nothing more.
    chollimahunter.github.io/remote-workers/ — Chollima Hunter · under “Kaspar Kruus” · pulled 2026-10-03

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2024-11-11
Repositories0 original, 0 forked
History older than the account0 repositories
Commits copied into others' repositories0
Commit identities0 addresses, 0 names

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-05. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: Kaspar Kruus

Other identifiers the reporting files under the same persona; 8 of 19 are shown.

All 19 on the Kaspar Kruus page

Cited by the same report: github.com/marvynpingul/CryptoRealTimePrice/commits

Chollima Hunter lists 4 other indicators in this source. 1 are shown, chosen across types.

All 5 indicators from this source

Cited by the same report: chollimahunter.github.io/remote-workers/

Chollima Hunter lists 37 other indicators in this source. 3 are shown, chosen across types.

All 38 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.