Chollima Hunter

← Remote Workers

https://github.com/bartlomiej-629

https://github.com/bartlomiej-629 is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The report is dated 2026-10-03.

The reporting files it under the persona Kaspar Kruus, alongside 19 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud UNDER REVIEW

First seen 2026-10-03 · last seen 2026-10-03

Source

  • Confirmed by Chollima Hunter research and rated high confidence; corroborated by Post listing Kaspar Kruus among the other personas of one operator, browsercookies on X. The name Kaspar Kruus is already in this site's index as one of seven aliases a researcher posted on 2 August 2025 as other personas of a single operator, alongside Ervin Halmi, Timur Sarv, Balasz Ballo, Gerson Stuva, Boudewijn Geiger and Oskar Teder. Chollima Hunter research then found the accounts filed here, all read on 3 October 2026. The profiles. torre.ai presents a senior full-stack developer in Tallinn, Estonia, working since 2014, at SENLA from 2022 to 2024 and Ronasit from 2015 to 2018, with a Central Arizona College degree. The Freelancer.com account kaspar033 shows Kaspar K., joined 7 March 2025, a principal full-stack engineer with more than ten years of experience, placed in the Philippines rather than Estonia. Both LinkedIn accounts the research recorded are now removed; kaspar-kruus-0982802b9 was already gone, and kaspar-kruus-aab966366 returned LinkedIn's not-found page on 3 October 2026. The GitHub account. The research gave github.com/petermantop, which no longer resolves under that login. It was renamed rather than deleted: a commit in veriff-face-api is authored as Kaspar KK under 165824649+petermantop@users.noreply.github.com, and 165824649 is the account ID of marvynpingul, created 2 April 2024 with the display name Marvyn. Under that account petermantop@gmail.com commits as petermantop, peter, kaspar, Kaspar and Kaspar Kruus from April 2024 to March 2026 (ai-pm-api, Crypto-OrderBook-Desk, CryptoRealTimePrice, DailyWordArticle, sku-frontend, sku-management-api, trading-settlement), and from May 2026 as Marvyn Pingul (nifi-flow-test): the same mailbox moving from this persona to a new name. CryptoRealTimePrice also carries a commit by Kaspar Kruus at kaspar@exzi.com, linked to the account Kasparexzi (created 11 November 2024, empty); Exzi is a cryptocurrency exchange. veriff-face-api, a repository named for an identity-verification provider's face check, was pushed on 20 May 2025 in ten commits by Kaspar Kruus at kaspar.kruus@atronous.ai, linked to kaspar-atrnous (created 1 April 2025, empty), the address that also signs a 2026 commit in Kaspar-Kruus99/LifeLedger. Kaspar-Kruus99 (created 3 April 2025, display name Kaspar) commits as kasparkruus99@outlook.com. Further accounts under the name are Kaspar-Kruus (January 2025), kaspar-kruus032 (March 2025) and DanielLeeDevMaster (June 2025, display name Kaspar Kruus, bio "Hello, I am a Senior Software Engineer."). The network. Kaspar-Kruus follows exactly two accounts, bartlomiej-629 (Bartlomiej Czeslaw Jakubowicz, BartlomiejCzeslaw@outlook.com) and bernardus-425 (Bernardus Besseler, bernardus.besseler@outlook.com), created five minutes apart on 5 February 2025. They hold the same set of about 27 projects each, created on the same days (an AI project-management API, a bank app, a hotel system, a rental platform, a Web3 message signer and others), and two of those projects also exist under marvynpingul. Both are followed by JamesWBeck (created March 2024, empty), which follows nothing else. A co-author on marvynpingul/ai-pm-api, memokey (skytopground@gmail.com, an account from 2022), is recorded as where those commits sit and nothing more.
    chollimahunter.github.io/remote-workers/ — Chollima Hunter · under “Kaspar Kruus” · pulled 2026-10-03

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2025-02-05
Repositories27 original, 1 forked
History older than the account0 repositories
Commits copied into others' repositories0
Commit identities2 addresses, 2 names; up to 2 addresses under one name

Commit addresses this index holds

Followed by these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-08. 1 other commit address is held for review rather than listed. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: Kaspar Kruus

Other identifiers the reporting files under the same persona; 8 of 19 are shown.

All 19 on the Kaspar Kruus page

Cited by the same report: chollimahunter.github.io/remote-workers/

Chollima Hunter lists 37 other indicators in this source. 4 are shown, chosen across types.

All 38 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.