Au Wai Lun
Also reported as: Warmice71AuWaiLun
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Au Wai Lun. The attribution is theirs, not this site's.
Portrait published in the cited post. It shows the image the identity presented as itself, which these personas routinely take from an uninvolved person or generate.
Identifiers attributed to this persona
3 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Au Wai Lun |
alias | |
AuWaiLun |
alias | |
https://github.com/warmice71 |
github profile | removed |
Au Wai Lun
alias IT Worker Fraud RESEARCHER POST
Source
-
The post describes this GitHub account as one of the few central accounts of the DPRK network on GitHub, used to promote and endorse the wider developer network rather than to carry a persona's own work, and warns that being followed by it is itself a signal. Four images are attached and the post text runs past the length the syndication endpoint returns, so only the account itself is transcribed; the follower and following lists it shows are not.
x.com/meow_mfer/status/1931532334324699203 — meow mfer (@meow_mfer)
AuWaiLun
alias IT Worker Fraud RESEARCHER POST
Source
-
The post describes this GitHub account as one of the few central accounts of the DPRK network on GitHub, used to promote and endorse the wider developer network rather than to carry a persona's own work, and warns that being followed by it is itself a signal. Four images are attached and the post text runs past the length the syndication endpoint returns, so only the account itself is transcribed; the follower and following lists it shows are not.
x.com/meow_mfer/status/1931532334324699203 — meow mfer (@meow_mfer)
https://github.com/warmice71
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as warmice71
removed
Sources
-
The post describes this GitHub account as one of the few central accounts of the DPRK network on GitHub, used to promote and endorse the wider developer network rather than to carry a persona's own work, and warns that being followed by it is itself a signal. Four images are attached and the post text runs past the length the syndication endpoint returns, so only the account itself is transcribed; the follower and following lists it shows are not.
x.com/meow_mfer/status/1931532334324699203 — meow mfer (@meow_mfer) -
…On the profile of Warmice71, there’s a repository at https://github.com/warmice71/vinci-store-product-scraping . In this repository, we found videos that capture the screen, showing interactions with a client while performing work on UpWork Press…
Summary of Findings on Suspicious GitHub Activity Linked to DPRK IT Workers — Coinmonks
Sources
- Summary of Findings on Suspicious GitHub Activity Linked to DPRK IT Workers — Coinmonks
- x.com/meow_mfer/status/1931532334324699203 — meow mfer (@meow_mfer)