omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh

omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh is a malicious repository that one published source reports in connection with Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The report is dated 2026-10-01.

malicious repository Konni CURATED Taken down checked 2026-11-08

First seen 2026-10-01 · last seen 2026-10-01

Source

  • SOCRadar's Operation Conflict Compass report (28 September 2026) names this GitHub account as the threat actor's and lists its four repositories as the VelvetCake staging infrastructure: the first-stage okay.md and the task-scheduling script history, the two zipped LNK lures (A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf and CV_OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative), and the trojanized zoominstaller.exe. Read through the GitHub API on 1 October 2026: the account was created on 18 August 2026, all four repositories were still public, and every commit is authored as omski00@outlook.com, the address SOCRadar gives for the actor. Nothing was downloaded.
    github.com/omskiwdcvoiuyfd0998 — Chollima Hunter · under “Konni VelvetCake repositories on the omskiwdcvoiuyfd0998 account” · pulled 2026-10-01

Find this indicator in the index, or see every malicious repository this site holds under Malicious repositories in the browse listing.

Related indicators

Cited by the same report: github.com/omskiwdcvoiuyfd0998

Chollima Hunter lists 3 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.