Every claim on this profile comes from the sources cited on it. Nothing has been added or inferred.
Ri Hyon Su (리현수; Hyon-Su Ri in the report) is profiled here as a member of the North Korean IT-worker cell that GitLab Threat Intelligence assesses is managed by Kang Kil Nam and is highly likely colocated and operating from Beijing. GitLab's assessed organization chart places Ri Hyon Su as a cell member in Working Group Two. On the cell's own performance slide for the third quarter of 2025, which the report reproduces, Ri Hyon Su (리현수) ranks 3 of seven, with 18,763 against target, 125 percent.
GitLab reports that the cell's personnel dossiers describe every member as a researcher at the Kim Il-sung University Joint Research Center in Beijing (베이징주재 김일성종합대학 공동연구중심 연구사), and suggests the cell's presence in China may be under an academic pretext.
The confidence level of 'medium' reflects that the name comes from GitLab's assessed organization chart and the cell's internal records as GitLab reads them. It is a private company's assessment, not a criminal charge, a sanctions designation or a court finding.
Identity photograph shown above the name Hyon-Su Ri on the organization chart of the Beijing cell published in the cited GitLab Threat Intelligence report, which GitLab describes as its assessment. Cropped from the report's image and reproduced for identification.Source: about.gitlab.com
Threat-intelligence report details
Status: Named on the organization chart of a North Korean IT-worker cell in Beijing published by GitLab Threat Intelligence on February 19, 2026
Name as printed
Hyon-Su Ri on GitLab's organization chart; 리현수 on the cell's performance slides
Role on GitLab's assessed organization chart
Cell Member, Working Group Two
Q3 2025 result on the cell's performance slide
Ranked 3 of seven, 18,763 against target (125 percent), under the initials RHS
Nationality
North Korean, per the report
Sources
Every factual claim on this page is drawn from the public records listed below.
