https://github.com/arturdranhoi
https://github.com/arturdranhoi is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The reporting files it under the persona Daniel Salo, alongside 7 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud CURATED live
live
Source
-
Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.
github.com/princecharming0115 — Chollima Hunter
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2023-05-29 |
|---|---|
| Repositories | 0 original, 0 forked |
| History older than the account | 0 repositories |
| Commits copied into others' repositories | 0 |
| Commit identities | 1 address, 1 name; up to 2 addresses under one name |