https://github.com/dragonv22

https://github.com/dragonv22 is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The report is dated 2026-09-28.

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-28 · last seen 2026-09-28

Source

  • github.com/bluedream74 is indexed from Heiner García's Wagemole article and now returns 404. The address bluedream7004@gmail.com carries 3,102 commits in GitHub's search, and GitHub credits them to github.com/dragonV22 (account id 137847214, created 27 June 2023); a sample of 100 commits authored under the name bluedream74 are all credited to dragonV22 as well. A git client writes the author name from local configuration, so an account still committing as bluedream74 is most likely the same holder, renamed or moved to a second account. That is an inference: no noreply address built from the account id under the old name was found, and the archived profile could not be retrieved on the day. The account's follow graph points the same way. It follows or is followed by seven accounts this index already holds as operators (superdev947, techwizard210, livedeveloper823, DevHawkNov, Lucky9596, 0xp3p3x0 and skycaptainess), where a control sample of 60 ordinary accounts created 2022 to 2024 averaged 0.5 such ties and never exceeded four. Two other repositories carry the address, struggle-Strug/smart_sms_1 and honeststack/customer_management_system_backend. Their owners and other contributors are not carried: shared commits alone do not separate an operator's collaborator from a client or employer, and one of them includes a corporate developer's commits.
    github.com/dragonV22 — Chollima Hunter · under “dragonV22, committing as the Wagemole account bluedream74” · pulled 2026-09-28

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2023-06-27
Repositories48 original, 5 forked
History older than the account6 repositories: dragonV22/airbnb (first commit 2023-03-22), dragonV22/vite-plugin-wasm-pack (first commit 2021-06-23), dragonV22/react-typescript-example (first commit 2020-11-17), dragonV22/next-webrtc (first commit 2021-02-13), dragonV22/quickstart-flutter (first commit 2022-03-07)
Commits copied into others' repositories0
Commit identities0 addresses, 0 names

Follows these indexed accounts

Followed by these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-11-09. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Cited by the same report: github.com/dragonV22

Chollima Hunter lists 23 other indicators in this source. 12 are shown, chosen across types.

All 24 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.