https://github.com/sheriff-rango
https://github.com/sheriff-rango is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-09-24.
github profile IT Worker Fraud CURATED live
live
Source
-
Read on 24 September 2026. lazarus.group attributes three GitHub accounts to the Eric Liu persona, github.com/vigorousdeveloper, github.com/SuperVenus0725 and github.com/Jason07250000, with the commit addresses vigorousdevelopment524@gmail.com and venus07250000@gmail.com; tayvano lists the same accounts. Searching GitHub for commits signed with those two addresses finds them inside repositories owned by six accounts this index did not hold. The accounts are recorded here as people the persona worked beside, not as further accounts of the persona: each commits under its own address and name, and nothing read so far shows one hand behind them. Three of the six were created on one day. github.com/loveFeynman (account id 95080253) was created at 10:53 UTC on 26 November 2021, github.com/kdbvier (95093693) at 15:34, and github.com/nightskydev (95094109) at 15:42, eight minutes after kdbvier. github.com/sheriff-rango (95250818) followed on 29 November 2021. The work is contemporaneous, not copied. In kdbvier/steampunks, kdbvier signed 21 commits and vigorousdeveloper 11 between 7 and 20 June 2022, and in kdbvier/Juno-Farming vigorousdeveloper signed 12 between 15 and 23 June 2022, followed by Jason07250000 in July. kdbvier/binance-trading-bot holds only the persona's commits, from January and April 2022. In nightskydev/picasso_frontend, created 19 June 2022, nightfury1111111111 signed 35 commits with linjay0208@gmail.com (the nightfury1111111111 account has since been deleted), the address every commit of nightskydev's own is signed with, while vigorousdeveloper signed 12 and kdbvier 6 over the same weeks; nightskydev/picasso_contract holds only the persona's commits. loveFeynman created mirror_protocol_stake_withdraw on 19 January 2022 and the persona committed into it as Eric Liu two days later; in loveFeynman/maui-frontend the two alternate across 2 to 5 January 2022. loveFeynman signs its own commits wando0226@gmail.com and willyu226@gmail.com under the names loveFeynman, wando and William Yu, and four commits signed William Yu with wando0226@gmail.com sit in vigorousdeveloper/NFT-AUCTION, dated 9 to 12 February 2022. sheriff-rango signed at least 99 commits in kdbvier/nfthope between 14 July and 13 September 2022. In frozenflux2/Solana_FE, created 23 February 2024, SuperVenus0725 committed with both of the persona's addresses in March 2024 beside frozenflux2's own aurora518star.com@gmail.com. The follow graph agrees. SuperVenus0725 and loveFeynman follow each other, as do loveFeynman and sheriff-rango; vigorousdeveloper follows loveFeynman, kdbvier and nightskydev; kdbvier follows loveFeynman and SuperVenus0725. Code also moved from these accounts into the persona's portfolio and back. loveFeynman's human_marketplace, first committed 13 August 2022, reappears with its history in SuperVenus0725/humanmarket (created 24 October 2022), sheriff-rango/HumansMarketplace and Calebtan978/HumansMarketplace. sheriff-rango created 24 repositories on 14 November 2022, 14 of which carry Jason07250000 commits from June 2022, and Calebtan978 holds eight carrying the same address. Calebtan978 is filed on weaker ground than the other five. Its repositories are copies rather than shared work, created in May 2023 over commits from 2022. What adds to it is the account itself, id 132147781, created at 14:02 UTC on 29 April 2023, four minutes after github.com/niceDeve (132147539), which this index holds from Coinmonks' reporting on DPRK-linked GitHub activity. An innocent reading was considered and set aside. A client who hires a contractor also creates repositories that the contractor then commits into, and nextnet-works, a company organisation with 266 repositories into which both SuperVenus0725 and loveFeynman committed in 2023, is left out for that reason. The six accounts above do not fit that reading: three were created within five hours of one another, they hold one another's code as portfolio, and they follow one another. KentaMori115 is also left out, because its only link is a 2023 copy of Juno-Farming carrying the persona's 2022 commits, which is how a copied repository looks.
github.com/sheriff-rango — Chollima Hunter
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.