← Remote Workers

https://github.com/sunlight0902

https://github.com/sunlight0902 is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Coinmonks. The report is dated 2025-07-22.

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-09-18

Listed as sunlight0902

First seen 2025-07-22 · last seen 2025-07-22

Source

• Nearby text:

  …https://github.com/codestar3524 https://github.com/topdev0215 https://github.com/Forest410 https://github.com/enzifiri https://github.com/sunlight0902 https://github.com/ERTWENTY Considering these patterns, I decided to analyze additional accounts with similar characteristics that also…

  Summary of Findings on Suspicious GitHub Activity Linked to DPRK IT Workers — Coinmonks · under “Fake developers related to Lazarus:” · published 2025-07-22 · pulled 2026-09-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: Summary of Findings on Suspicious GitHub Activity Linked to DPRK IT Workers

Coinmonks lists 25 other indicators in this source. 12 are shown, chosen across types.

• goodfriend9290@gmail.com email address
• https://github.com/0xb10ckdev GitHub account
• https://github.com/ai0228 GitHub account
• https://github.com/blockchainyou GitHub account
• https://github.com/bstar0406 GitHub account
• https://github.com/capitalist42 GitHub account
• https://github.com/supercoder-0923 GitHub account
• https://github.com/topdev0215 GitHub account
• https://github.com/warmice71 GitHub account
• https://github.com/webrabbit1796 GitHub account
• https://github.com/whiterabbit130 GitHub account
• https://www.linkedin.com/in/onder-kayabasi-772a33302/ LinkedIn account

All 26 indicators from this source