https://github.com/kamaalsultan
https://github.com/kamaalsultan is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Nisos.
The report is dated 2025-03-19.
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
Nisos's report of 19 March 2025, "Likely DPRK Network Backstops on GitHub, Targets Companies Globally", published on its site and as a LinkedIn article whose full text is a PDF, tracks personas posing as Vietnamese, Japanese and Singaporean developers that reuse matured GitHub accounts and portfolio content from older personas, and whose addresses recur with the number 116 and the word dev. The values here are from the report's contact table and its footnotes. The companies the personas list as employers are not carried as indicators. The report lists okino.takayuki.dev@gmail.com as a contact address associated with the GitHub accounts superbluestar and kamaalsultan without assigning it to a persona, and shows from kamaalsultan's commits that several GitHub users worked on several personas, including two named Karl Chong and Yoshiro Morino; the two sites are the examples it gives of personas created on GitHub, kanbei-profile.vercel.app carrying the Karl Chong resume.
6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/dprk-github-employment-fraud.pdf — Nisos
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.