`https://github.com/kanbei0605`

https://github.com/kanbei0605 is a GitHub account that 3 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Nisos and The Raven File. The earliest of those reports is dated 2025-03-27 and the most recent 2026-10-18.

github profile IT Worker Fraud MATCHED IN SOURCE live checked 2026-09-18

Listed as kanbei0605

Listed under Karl Chong, Roman Kryveha.

First seen 2025-03-27 · last seen 2026-10-18

live checked 2026-09-18

The image is the avatar this account displays, not evidence of who operates it.

Sources

Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's text says this persona reused Karl Chong's about-me paragraph and stock photograph; its network map draws a direct line from the persona to the GitHub account kanbei0605 and a commit-derived line to imcode65. Both accounts are carried here as Nisos's attribution, and a line found on commits is a weaker tie than a direct one.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Roman Kryveha” · published 2025-03-27 · pulled 2026-09-18
Nearby text:

…/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 htt…
DPRK IT WORKERS UNVEILED – THE RAVEN FILE — The Raven File · under “GITHUB ACCOUNTS OF DPRK IT WORKERS AKA JASPER SLEET” · published 2025-08-28 · pulled 2026-08-30
Nearby text:

…/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 htt…
DPRK GitHub Accounts — The Raven File · published 2025-08-31 · pulled 2026-09-18

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created	2022-10-25
Repositories	5 original, 0 forked
History older than the account	0 repositories
Commits copied into others' repositories	0
Commit identities	0 addresses, 0 names
Name then four digits	`kanbei0605`

Follows these indexed accounts

Followed by these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-05. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: Karl Chong

Other identifiers the reporting files under the same persona; 4 of 11 are shown.

All 11 on the Karl Chong page

Same persona record: Roman Kryveha

Other identifiers the reporting files under the same persona.

Cited by the same report: nisos.com/research/dprk-it-worker-scam-mitigation/

Nisos lists 13 other indicators in this source. 3 are shown, chosen across types.

All 14 indicators from this source

Cited by the same report: DPRK IT WORKERS UNVEILED – THE RAVEN FILE

The Raven File lists 78 other indicators in this source. 1 are shown, chosen across types.

All 79 indicators from this source