bestselection18/Automation-bot
bestselection18/Automation-bot is a malicious repository
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from bbsz (@blackbigswan).
The report is dated 2025-04-16.
The reporting files it under the persona Ketman, alongside 3 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
malicious repository IT Worker Fraud RESEARCHER POST Taken down
Source
-
The report on DPRK IT workers on the OnlyDust platform opens with the GitHub account 0xExp-po, finds in bestselection18's Automation-bot repository clues to how many fake identities the actor runs, and ties the V0410 identity to a Fiverr gig and a LinkedIn profile under the name Maksym Poplavskyi, deleted by the time of writing.
www.ketman.org/dprk-it-workers-in-freelance-platform-onlyDust.html — bbsz (@blackbigswan)
Find this indicator in the index, or see every malicious repository this site holds under Malicious repositories in the browse listing.