`https://github.com/chainstacker`

https://github.com/chainstacker is a GitHub account that 2 published sources report in connection with Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from SentinelOne and ReversingLabs. The earliest of those reports is dated 2026-09-18 and the most recent 2026-11-04.

github profile Lazarus Group APT38 MATCHED IN SOURCE live checked 2026-09-30

Listed as chainstacker

First seen 2026-09-18 · last seen 2026-11-04

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Sources

…Weaponized Terraform lock file hashicorp-aws.io Provider: https://github.com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/.terraform.lock.hcl Weaponized Terraform lock file…
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne — SentinelOne · under “Coding Challenge Repositories” · published 2026-09-18 · pulled 2026-09-29
…pivot in RL data github.com/exubient0/terraform-candidate-repo URL Lure repository with weaponized lock file (SentinelOne) github.com/chainstacker/Northwind-IAC URL Lure repository with weaponized lock file (SentinelOne) https://sites.google.com/view/brewpage URL Fake Homebrew page…
Binance heist: a fake interview, a trojanized pyenv, and what RL sees | RL Blog — ReversingLabs · under “Keep learning” · published 2026-11-04 · pulled 2026-11-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created	2025-04-19
Repositories	1 original, 6 forked
History older than the account	0 repositories
Commits copied into others' repositories	0
Commit identities	1 address, 1 name

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-31. 1 other commit address is held for review rather than listed. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Cited by the same report: Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne

SentinelOne lists 12 other indicators in this source. 7 are shown, chosen across types.

All 13 indicators from this source

Cited by the same report: Binance heist: a fake interview, a trojanized pyenv, and what RL sees | RL Blog

ReversingLabs lists 10 other indicators in this source. 5 are shown, chosen across types.

All 11 indicators from this source