black02430horse
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, black02430horse. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Identifiers attributed to this persona
4 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
black02430horse@gmail.com |
email address | |
https://freelancer.com/u/black02430horse |
freelancer account | |
https://github.com/black02430horse |
github profile | removed |
https://github.com/vihsonic |
github profile | live |
black02430horse@gmail.com
email address IT Worker Fraud CURATED
Sources
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. The second operator on the bridge front end, August 2024 to February 2025, whose GitHub account has since been deleted; the commits remain under this address. Post four describes a tool this account built and ran that harvested pending-transaction data from the Titan chain. The thread notes the handle fits a naming pattern the researcher sees across other DPRK accounts.
x.com/meow_mfer/status/2045105256120693242 — meow mfer (@meow_mfer) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/vihsonic is account id 147780742, created on 13 October 2023. Its noreply addresses name the handles black02430horse and vihsonic, so it is github.com/black02430horse, which meow_mfer names and tayvano lists, renamed; black02430horse now returns not found. 91 of its 100 own commits are signed black02430horse@gmail.com.
github.com/vihsonic — Chollima Hunter
https://freelancer.com/u/black02430horse
freelancer account IT Worker Fraud CURATED
Source
-
Found on 18 September 2026 by putting black02430horse, the GitHub login this persona is named for, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. Freelancer returns the account with the display name Closed User and a registration date of 30 October 2023: an account existed under the handle and has since been closed, which is recorded here because a closed account is still a registration, and the date is the one fact it states. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
www.freelancer.com/u/black02430horse — Chollima Hunter
https://github.com/black02430horse
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as black02430horse
Also listed under Victor Hazard — this value’s page names all of them.
removed
Sources
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. The second operator on the bridge front end, August 2024 to February 2025, whose GitHub account has since been deleted; the commits remain under this address. Post four describes a tool this account built and ran that harvested pending-transaction data from the Titan chain. The thread notes the handle fits a naming pattern the researcher sees across other DPRK accounts.
x.com/meow_mfer/status/2045105256120693242 — meow mfer (@meow_mfer) -
…on Safe 0x0f4 #### Victor Hazard - vihazard430@gmail.com - hazardvictor@hotmail.com - linkedin.com/in/victor-hazard-77ba40305 - github.com/black02430horse - github.com/hazardvictor - happy3guy@gmail.com - victordev67@gmail.com - 0xefcb06b5ea58fb451c64ec278d957f4ebfd26df7 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/vihsonic
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/vihsonic is account id 147780742, created on 13 October 2023. Its noreply addresses name the handles black02430horse and vihsonic, so it is github.com/black02430horse, which meow_mfer names and tayvano lists, renamed; black02430horse now returns not found. 91 of its 100 own commits are signed black02430horse@gmail.com.
github.com/vihsonic — Chollima Hunter
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- x.com/meow_mfer/status/2045105256120693242 — meow mfer (@meow_mfer)
- www.freelancer.com/u/black02430horse — Chollima Hunter
- github.com/vihsonic — Chollima Hunter