https://www.linkedin.com/in/renz-patdu-9992423b0/
https://www.linkedin.com/in/renz-patdu-9992423b0/ is a LinkedIn account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-10-03.
The reporting files it under the persona Renz Patdu, alongside 3 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
linkedin profile IT Worker Fraud UNDER REVIEW
Source
-
Confirmed by Chollima Hunter research and rated medium confidence; corroborated by Table 1: Russian IP ranges used in suspected North Korea-related campaigns, including 80.237.87.0/24, Trend Micro; TTK addresses associated with North Korean IT workers, including 80.237.87.21, ReliaQuest. From Chollima Hunter research, read on 3 October 2026. The applicant presenting as Renz Patdu, at renzpatdu0601@gmail.com, was recorded active from 80.237.87.36. That address is in 80.237.87.0/24, registered in RIPE as SKYFREIGHT-NET under TransTeleCom (AS20485) with the description "SKYFREIGHT, Hasan, Russia" and a Khabarovsk contact. Trend Micro lists that exact range, created in December 2024 and located at Khasan on the Russia-North Korea border, among the Russian ranges used in suspected North Korea-related campaigns, and ReliaQuest lists 80.237.87.21, in the same /24, among the TransTeleCom addresses used by North Korean IT workers. LinkedIn's people search returns two accounts under the name. renz-patdu-9992423b0 joined LinkedIn in February 2026 and presents a Senior Software Engineer at Atlassian in San Fernando, the Philippines, educated at Fudan University in Shanghai, with 54 connections and no verifications. renz-patdu-6a12373ba joined in March 2026 and presents a Senior Data Scientist at Antiland in Pasig, with no connections or posts. Which account the applicant used is not recorded.
chollimahunter.github.io/remote-workers/ — Chollima Hunter
Find this indicator in the index, or see every LinkedIn account this site holds under LinkedIn accounts in the browse listing.