2401
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, 2401. The attribution is theirs, not this site's.
The persona card the researcher published. The photograph is the one the identity presented and is not necessarily a picture of whoever operated it.
Identifiers attributed to this persona
2 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
https://github.com/aimachieve |
github profile | removed |
https://t.me/bluestar0805 |
telegram account | live |
https://github.com/aimachieve
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as aimachieve
removed
Sources
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "Senior Rust Engineer" and links to GitHub and Telegram.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies) -
…Ninja - t.me/leonk0804 - https://x.com/browsercookies/status/1933591202550723029 -  #### 2401 - github.com/aimachieve - t.me/BlueStar0805 - https://x.com/browsercookies/status/1933591202550723029 -  #### MISC -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…GitHub Indicators https://github.com/Achilleus0612 https://github.com/adminGit71 https://github.com/aimachieve https://github.com/alchemist0404 https://github.com/Blux61 https://github.com/boldempha https://github.com/Bravodev88 https://github.c…
Cyber Saga: In the Footsteps of the DPRK IT Workers | Group-IB Blog — Group-IB
https://t.me/bluestar0805
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as bluestar0805
live
Sources
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "Senior Rust Engineer" and links to GitHub and Telegram.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies) -
…https://x.com/browsercookies/status/1933591202550723029 -  #### 2401 - github.com/aimachieve - t.me/BlueStar0805 - https://x.com/browsercookies/status/1933591202550723029 -  #### MISC - snowjaguar625 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- Cyber Saga: In the Footsteps of the DPRK IT Workers | Group-IB Blog — Group-IB
- x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies)