https://keybase.io/ashpala
https://keybase.io/ashpala is a Keybase account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The reporting files it under the persona He-Song Cui, alongside 15 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
keybase account IT Worker Fraud CURATED live
live
Source
-
Found on 17 September 2026 by asking Keybase whether an account exists under ashpala, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 10 March 2023 and no display name but the handle itself. The profile carries a signed proof claiming the GitHub account jsreputation. A Keybase proof is a statement posted to the other account and signed by this one, so it evidences that whoever held this login also held that account at the time it was posted. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
keybase.io/ashpala — Chollima Hunter
Find this indicator in the index, or see every Keybase account this site holds under Keybase accounts in the browse listing.
Related indicators
Same persona record: He-Song Cui
All 15 on the He-Song Cui page