https://github.com/ares-dev05
https://github.com/ares-dev05 is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies).
The report is dated 2025-04-21.
The reporting files it under the persona ares-dev05. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The account name is transcribed by hand from the screenshot attached to the post, a GitHub profile page carrying the handle ares-dev05 under the display name Full Stack Developer. The post states the account has direct links to Kan Bei, also known as Karl Chong, and cites Nisos research on that actor. The address codingninjaprox@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1914447327974318298 — Cookie Connoisseur (@browsercookies)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2021-04-26 |
|---|---|
| Repositories | 41 original, 7 forked |
| History older than the account | 0 repositories |
| Commits copied into others' repositories | 0 |
| Commit identities | 5 addresses, 10 names; up to 9 names on one address; up to 4 addresses under one name |