`https://github.com/0xopsdev`

https://github.com/0xopsdev is a GitHub account that 3 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from tayvano (lazarus-bluenoroff-research), ketman.org and Kawaii Jong UwUn (HyperBuildX-Continued-Research). The earliest of those reports is dated 2025-10-01 and the most recent 2026-11-13.

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-08-30

Listed as 0xopsdev

First seen 2025-10-01 · last seen 2026-11-13

removed checked 2026-08-30

Sources

…x.com/0xMuse9 - x.com/0xnightfly github.com/0xnightfly - x.com/0xopsdev github.com/0xopsdev - x.com/akratos_god github.com/kratos-te - x.com/d0sc4u - x.com/EleazarTlapala - x.com/norocos_cp - x.com/soladify github.com/soladify -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “0xopsdev” · published 2025-06-19 · pulled 2026-08-30
…are spun from endlessly forked repositories and sprinkled with some simple UI changes and re-branding. 0xOpsDev Github URL: https://github.com/0xopsdev Other names: ZireaelGit, MinionGit, meta0xflip E-mail: nelo.labhart@gmail.com On-chain: 0x7a87c66718255c5be3c0607e134592d9a8bdb32c…
Spotted a Weird Github Organization? It Might be DPRK! - Ketman - Threat intelligence for remote and open source organizations — ketman.org · under “0xOpsDev” · published 2025-10-01 · pulled 2026-08-30
…{"id":"49c1e60b71ef30f1","type":"link","url":"https://github.com/0xopsdev","x":4620,"y":1580,"width":400,"height":400},…
HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 5 are shown, chosen across types.

All 855 indicators from this source

Cited by the same report: Spotted a Weird Github Organization? It Might be DPRK! - Ketman - Threat intelligence for remote and open source organizations

ketman.org lists 47 other indicators in this source. 4 are shown, chosen across types.

All 48 indicators from this source

Cited by the same report: HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub

Kawaii Jong UwUn (HyperBuildX-Continued-Research) lists 44 other indicators in this source. 3 are shown, chosen across types.

All 45 indicators from this source