https://github.com/togetherlabsinchub
https://github.com/togetherlabsinchub is a GitHub account
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-10-26.
github profile Contagious Interview CURATED removed
removed
Source
-
Endpoint telemetry from a developer who downloaded the main-branch archive of togetherlabsinchub/palooza from GitHub, reported to this site in October 2026, shows the project started with node server.js and then a Node.js child process run inline with node -e, carrying a campaign identifier, a numeric key and the C2 address http://151.80.76.64:1224/. That shape, an inline loader calling back to port 1224 and identifying itself to the server, is the BeaverTail first stage of the Contagious Interview campaign, delivered as a coding exercise in a fake job interview. The account name borrows that of Together Labs, Inc., a real company with no part in this; impersonating a real employer is the campaign's usual lure. By 26 October 2026 the account and the repository both returned not found through the GitHub API, and the Wayback Machine holds no capture of either, so the repository is listed as a removed link. Nothing from it was downloaded or run. Maltrail's Lazarus trail list carries 151.80.76.64 on ports 1224 and 3333 (the BeaverTail and InvisibleFerret ports), together with 151.80.76.66 and 151.80.76.67 on the same two ports. All three sit on OVH in Roubaix, rented through the Windows VPS reseller RDP Quick with remote desktop open. Shodan's InternetDB on 26 October 2026 showed a Node.js Express server on 151.80.76.64 port 3333 and on 151.80.76.66 port 1224, so at least two of the three were serving that day.
github.com/togetherlabsinchub/palooza — Chollima Hunter
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.