Sourcing & confidence disclaimer

Every claim on this profile comes from the sources cited on it. Nothing has been added or inferred.

Kim Won Jin (김원진; Won-Jin Kim in the report) is profiled here as a member of the North Korean IT-worker cell that GitLab Threat Intelligence assesses is managed by Kang Kil Nam and is highly likely colocated and operating from Beijing. GitLab's assessed organization chart places Kim Won Jin as a cell member in Working Group Two. GitLab reports that in the third quarter of 2025 Kim Won Jin was dropped from tracking and the related documentation was moved to a directory marked 귀국 ("return to the home country"), and assesses that the departure is unlikely to relate to earnings, which had been consistently high relative to other members.

The report gives this name in romanised form only. The Hangul above is this site's reconstruction from that romanisation and is not cited; search the romanised name.

GitLab reports that the cell's personnel dossiers describe every member as a researcher at the Kim Il-sung University Joint Research Center in Beijing (베이징주재 김일성종합대학 공동연구중심 연구사), and suggests the cell's presence in China may be under an academic pretext.

The confidence level of 'medium' reflects that the name comes from GitLab's assessed organization chart and the cell's internal records as GitLab reads them. It is a private company's assessment, not a criminal charge, a sanctions designation or a court finding.

Attribution confidence: medium

If this entry concerns you, see If you are listed on this site.

Kim Won Jin 김원진 medium

The Korean rendering above follows the conventional spelling of the romanized name; it is not taken from a source that publishes the Hangul.

Also known as: Won-Jin Kim

Actor-cluster tags

Remote Worker Fraud / Contagious Interview

Photo

Photograph of Kim Won Jin
Identity photograph shown above the name Won-Jin Kim on the organization chart of the Beijing cell published in the cited GitLab Threat Intelligence report, which GitLab describes as its assessment. Cropped from the report's image and reproduced for identification.Source: about.gitlab.com

Threat-intelligence report details

Status: Named on the organization chart of a North Korean IT-worker cell in Beijing published by GitLab Threat Intelligence on February 19, 2026

Name as printedWon-Jin Kim on GitLab's organization chart and in the report's text; no Hangul form is given
Role on GitLab's assessed organization chartCell Member, Working Group Two
Status in the cell's recordsDropped from tracking in Q3 2025; documentation moved to a directory marked 귀국 ("return to the home country")
NationalityNorth Korean, per the report

Sources

Every factual claim on this page is drawn from the public records listed below.

Profile last updated 2026-10-02.