Chollima Hunter

← Remote Workers

https://github.com/0xexp-po

https://github.com/0xexp-po is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from bbsz (@blackbigswan). The report is dated 2025-04-16.

The reporting files it under the persona Ketman, alongside 3 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-30

First seen 2025-04-16 · last seen 2025-04-16

Source

  • The report on DPRK IT workers on the OnlyDust platform opens with the GitHub account 0xExp-po, finds in bestselection18's Automation-bot repository clues to how many fake identities the actor runs, and ties the V0410 identity to a Fiverr gig and a LinkedIn profile under the name Maksym Poplavskyi, deleted by the time of writing.
    www.ketman.org/dprk-it-workers-in-freelance-platform-onlyDust.html — bbsz (@blackbigswan) · under “OnlyDust freelance identities (Ketman)” · published 2025-04-16 · pulled 2026-09-29

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Same persona record: Ketman

Other identifiers the reporting files under the same persona.

Cited by the same report: www.ketman.org/dprk-it-workers-in-freelance-platform-onlyDust.html

bbsz (@blackbigswan) lists 39 other indicators in this source. 9 are shown, chosen across types.

All 40 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.