888 cluster

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, 888 cluster. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-06-06

Identifiers attributed to this persona

11 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
https://github.com/alexandrs888 github profile live checked 2026-09-02
https://github.com/alexey-dev888 github profile live checked 2026-09-02
https://github.com/kevin-dev888 github profile live checked 2026-09-02
https://github.com/kjohn888 github profile live checked 2026-09-02
https://github.com/takumi-dev888 github profile live checked 2026-09-02
https://medium.com/@dev.solution888 medium account not checked
https://medium.com/@suko.m.0888 medium account not checked
https://quora.com/profile/solution-888 quora account not checked
https://t.me/alexandrs888 telegram account live checked 2026-11-08
https://x.com/army_boris888 x account not checked
https://x.com/kevindev888 x account not checked

https://github.com/alexandrs888

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-06-06 · last seen 2025-06-06

Sources

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30
  • A three-post thread opening "Just a DPRK boyz (same boy) GitHub accts", followed by two posts reading "Few mo". Every account is transcribed by hand from the twelve attached profile captures. The researcher states that all twelve belong to one operator but never names that operator, so they are recorded as an attributed set without a persona rather than under a name this site would have had to invent. Two of the captures corroborate the grouping from inside: the AngelCat0990 account's only repository is a fork of one belonging to 3D-Dev, and the proactive-dev and prodev90 accounts present under near-identical display names. The address is transcribed from the Anton-Dev97 profile, whose biography reads "Senior Software Developer and Hacker Team Leader" followed by it. One of the twelve has since changed hands. The 3D-Dev login was checked on 1 September 2026 and resolves to an account created on 28 October 2025 holding no repositories and no followers, where the capture in the cited post shows 157 repositories and 1,300 followers in June 2025. The original was deleted and the name taken by someone else, so whoever holds it now has no connection to anything here; the identifier is kept because the post published it, not as a pointer to the account answering today. The address youngmobileguy@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address suko.m@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address proactive.d20@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address ts199111st@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/browsercookies/status/1930806306287612005 — Cookie Connoisseur (@browsercookies) · under “GitHub accounts browsercookies attributes to a single unnamed operator” · published 2025-06-06 · pulled 2026-08-30

https://github.com/alexey-dev888

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-06-06 · last seen 2025-06-06

Sources

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30
  • A three-post thread opening "Just a DPRK boyz (same boy) GitHub accts", followed by two posts reading "Few mo". Every account is transcribed by hand from the twelve attached profile captures. The researcher states that all twelve belong to one operator but never names that operator, so they are recorded as an attributed set without a persona rather than under a name this site would have had to invent. Two of the captures corroborate the grouping from inside: the AngelCat0990 account's only repository is a fork of one belonging to 3D-Dev, and the proactive-dev and prodev90 accounts present under near-identical display names. The address is transcribed from the Anton-Dev97 profile, whose biography reads "Senior Software Developer and Hacker Team Leader" followed by it. One of the twelve has since changed hands. The 3D-Dev login was checked on 1 September 2026 and resolves to an account created on 28 October 2025 holding no repositories and no followers, where the capture in the cited post shows 157 repositories and 1,300 followers in June 2025. The original was deleted and the name taken by someone else, so whoever holds it now has no connection to anything here; the identifier is kept because the post published it, not as a pointer to the account answering today. The address youngmobileguy@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address suko.m@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address proactive.d20@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address ts199111st@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/browsercookies/status/1930806104147267866 — Cookie Connoisseur (@browsercookies) · under “GitHub accounts browsercookies attributes to a single unnamed operator” · published 2025-06-06 · pulled 2026-08-30

https://github.com/kevin-dev888

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-06-06 · last seen 2025-06-06

Source

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30

https://github.com/kjohn888

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-06-06 · last seen 2025-06-06

Source

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30

https://github.com/takumi-dev888

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-06-06 · last seen 2025-06-06

Source

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30

https://medium.com/@dev.solution888

medium account IT Worker Fraud RESEARCHER POST

First seen 2025-06-06 · last seen 2025-06-06

Source

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30

https://medium.com/@suko.m.0888

medium account IT Worker Fraud RESEARCHER POST

First seen 2025-06-06 · last seen 2025-06-06

Source

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30

https://quora.com/profile/solution-888

quora account IT Worker Fraud RESEARCHER POST

First seen 2025-06-06 · last seen 2025-06-06

Source

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30

https://t.me/alexandrs888

telegram account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by putting alexandrs888, one of the GitHub logins browsercookies grouped into this cluster, to Maigret's username search and reading the Telegram page it reported, cited here. The page states the display name Alexandr and no bio. The display name is kept here rather than carried as an alias, because a bare given name on a Telegram page is not a name the operator presents to an employer, and the cluster itself is a grouping of accounts rather than a person. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    t.me/alexandrs888 — Chollima Hunter · under “888 cluster” · pulled 2026-09-18

https://x.com/army_boris888

x account IT Worker Fraud RESEARCHER POST

First seen 2025-06-06 · last seen 2025-06-06

Source

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30

https://x.com/kevindev888

x account IT Worker Fraud RESEARCHER POST

First seen 2025-06-06 · last seen 2025-06-06

Source

  • The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
    x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) · under “888 cluster” · published 2025-06-06 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. 888 cluster as the name of the operator is the cited researcher’s assertion, repeated here as their claim.