888 cluster
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, 888 cluster. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Identifiers attributed to this persona
11 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
https://github.com/alexandrs888 |
github profile | live |
https://github.com/alexey-dev888 |
github profile | live |
https://github.com/kevin-dev888 |
github profile | live |
https://github.com/kjohn888 |
github profile | live |
https://github.com/takumi-dev888 |
github profile | live |
https://medium.com/@dev.solution888 |
medium account | |
https://medium.com/@suko.m.0888 |
medium account | |
https://quora.com/profile/solution-888 |
quora account | |
https://t.me/alexandrs888 |
telegram account | live |
https://x.com/army_boris888 |
x account | |
https://x.com/kevindev888 |
x account |
https://github.com/alexandrs888
github profile IT Worker Fraud RESEARCHER POST live
live
Sources
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) -
A three-post thread opening "Just a DPRK boyz (same boy) GitHub accts", followed by two posts reading "Few mo". Every account is transcribed by hand from the twelve attached profile captures. The researcher states that all twelve belong to one operator but never names that operator, so they are recorded as an attributed set without a persona rather than under a name this site would have had to invent. Two of the captures corroborate the grouping from inside: the AngelCat0990 account's only repository is a fork of one belonging to 3D-Dev, and the proactive-dev and prodev90 accounts present under near-identical display names. The address is transcribed from the Anton-Dev97 profile, whose biography reads "Senior Software Developer and Hacker Team Leader" followed by it. One of the twelve has since changed hands. The 3D-Dev login was checked on 1 September 2026 and resolves to an account created on 28 October 2025 holding no repositories and no followers, where the capture in the cited post shows 157 repositories and 1,300 followers in June 2025. The original was deleted and the name taken by someone else, so whoever holds it now has no connection to anything here; the identifier is kept because the post published it, not as a pointer to the account answering today. The address youngmobileguy@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address suko.m@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address proactive.d20@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address ts199111st@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1930806306287612005 — Cookie Connoisseur (@browsercookies)
https://github.com/alexey-dev888
github profile IT Worker Fraud RESEARCHER POST live
live
Sources
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) -
A three-post thread opening "Just a DPRK boyz (same boy) GitHub accts", followed by two posts reading "Few mo". Every account is transcribed by hand from the twelve attached profile captures. The researcher states that all twelve belong to one operator but never names that operator, so they are recorded as an attributed set without a persona rather than under a name this site would have had to invent. Two of the captures corroborate the grouping from inside: the AngelCat0990 account's only repository is a fork of one belonging to 3D-Dev, and the proactive-dev and prodev90 accounts present under near-identical display names. The address is transcribed from the Anton-Dev97 profile, whose biography reads "Senior Software Developer and Hacker Team Leader" followed by it. One of the twelve has since changed hands. The 3D-Dev login was checked on 1 September 2026 and resolves to an account created on 28 October 2025 holding no repositories and no followers, where the capture in the cited post shows 157 repositories and 1,300 followers in June 2025. The original was deleted and the name taken by someone else, so whoever holds it now has no connection to anything here; the identifier is kept because the post published it, not as a pointer to the account answering today. The address youngmobileguy@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address suko.m@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address proactive.d20@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address ts199111st@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1930806104147267866 — Cookie Connoisseur (@browsercookies)
https://github.com/kevin-dev888
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
https://github.com/kjohn888
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
https://github.com/takumi-dev888
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
https://medium.com/@dev.solution888
medium account IT Worker Fraud RESEARCHER POST
Source
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
https://medium.com/@suko.m.0888
medium account IT Worker Fraud RESEARCHER POST
Source
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
https://quora.com/profile/solution-888
quora account IT Worker Fraud RESEARCHER POST
Source
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
https://t.me/alexandrs888
telegram account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by putting alexandrs888, one of the GitHub logins browsercookies grouped into this cluster, to Maigret's username search and reading the Telegram page it reported, cited here. The page states the display name Alexandr and no bio. The display name is kept here rather than carried as an alias, because a bare given name on a Telegram page is not a name the operator presents to an employer, and the cluster itself is a grouping of accounts rather than a person. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
t.me/alexandrs888 — Chollima Hunter
https://x.com/army_boris888
x account IT Worker Fraud RESEARCHER POST
Source
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
https://x.com/kevindev888
x account IT Worker Fraud RESEARCHER POST
Source
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
Sources
- x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1930806104147267866 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1930806306287612005 — Cookie Connoisseur (@browsercookies)
- t.me/alexandrs888 — Chollima Hunter