← All actor clusters

https://github.com/exubient0

https://github.com/exubient0 is a GitHub account that 2 published sources report in connection with Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from SentinelOne and ReversingLabs. The earliest of those reports is dated 2026-09-18 and the most recent 2026-11-04.

github profile Lazarus GroupAPT38 MATCHED IN SOURCE live checked 2026-09-30

Listed as exubient0

First seen 2026-09-18 · last seen 2026-11-04

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Sources

• …www.mactroubleshoots.pro www.tinklify.com Coding Challenge Repositories hashicorp-aws.com Provider: https://github.com/exubient0/terraform-candidate-repo/blob/main/.terraform.lock.hcl Weaponized Terraform lock file…

  Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne — SentinelOne · under “Coding Challenge Repositories” · published 2026-09-18 · pulled 2026-09-29

• …Toolset infrastructure (SentinelOne) grenight.com Domain Toolset infrastructure (SentinelOne); noisy pivot in RL data github.com/exubient0/terraform-candidate-repo URL Lure repository with weaponized lock file (SentinelOne) github.com/chainstacker/Northwind-IAC URL Lure repository with…

  Binance heist: a fake interview, a trojanized pyenv, and what RL sees | RL Blog — ReversingLabs · under “Keep learning” · published 2026-11-04 · pulled 2026-11-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-11-12. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Cited by the same report: Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne

SentinelOne lists 12 other indicators in this source. 7 are shown, chosen across types.

• 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82 file hash
• 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa file hash
• 5728b11d30586bbfc1d8bd12df1c722a06e767a2 file hash
• https://github.com/radupopa369 GitHub account
• https://github.com/ryanlray GitHub account
• 45.11.59.140 IP address
• 85.137.56.10 IP address

All 13 indicators from this source

Cited by the same report: Binance heist: a fake interview, a trojanized pyenv, and what RL sees | RL Blog

ReversingLabs lists 10 other indicators in this source. 5 are shown, chosen across types.

• AS6698 autonomous system number
• 4402e44c0bc959ac22340041413de2482e8b5d53 file hash
• https://github.com/chainstacker GitHub account
• 176.97.114.232 IP address
• https://pastebin.com/raw/3yptBDhL payload URL

All 11 indicators from this source