https://github.com/rossryuli
https://github.com/rossryuli is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies).
The report is dated 2025-04-21.
The reporting files it under the persona Josh Mack, alongside 3 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The post asserts one identity outright, that Josh Mack and the GitHub account rossryuli are the same. The rest it states as links rather than equivalences: Kanbei is linked to mjoshalchi@gmail.com, and that address to rossryuli. The IP address is given as Russian and appears in the post immediately after the rossryuli line. The researcher writes the address without a top-level domain, as mjoshalchi[@]gmail.
x.com/browsercookies/status/1914447750445588965 — Cookie Connoisseur (@browsercookies)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2023-11-05 |
|---|---|
| Repositories | 3 original, 0 forked |
| History older than the account | 0 repositories |
| Commits copied into others' repositories | 0 |
| Commit identities | 1 address, 1 name; up to 2 addresses under one name |