Chollima Hunter

← Remote Workers

https://x.com/weara17

https://x.com/weara17 is an X account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cookie Connoisseur (@browsercookies). The report is dated 2025-06-06.

x account IT Worker Fraud RESEARCHER POST

First seen 2025-06-06 · last seen 2025-06-06

Source

  • The post greets five X accounts as DPRK operators without saying whether they are one person or several. Two of the five carry the 888 marker and are recorded against the 888 cluster; these three carry no marker and are left unattributed, because grouping them would be this site's inference.
    x.com/browsercookies/status/1930804977091711320 — Cookie Connoisseur (@browsercookies) · under “X accounts greeted as DPRK on 6 June 2025” · published 2025-06-06 · pulled 2026-08-30

Find this indicator in the index, or see every X account this site holds under X accounts in the browse listing.

Related indicators

Cited by the same report: x.com/browsercookies/status/1930804977091711320

Cookie Connoisseur (@browsercookies) lists 2 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.