https://github.com/ronansteel
https://github.com/ronansteel is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies).
The report is dated 2025-07-24.
The reporting files it under the persona Kim Song Gyu, alongside 7 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud RESEARCHER POST removed
removed
Source
-
Read from the table image the post carries, rather than from its text. The post is the head of the thread whose later parts this file already cites: those parts restate the table in plain text, and the cells transcribed here are the ones no part reached. The researcher's own layout is what supplies the attribution -- a cell is headed with a Korean name and lists the aliases, accounts and addresses filed under it. The cell lists two GitHub accounts and two addresses under one name; the pairing between them is not stated and is not inferred here.
x.com/browsercookies/status/1948426426145005680 — Cookie Connoisseur (@browsercookies)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Related indicators
Same persona record: Kim Song Gyu
All 7 on the Kim Song Gyu page