Brian Young
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Brian Young. The attribution is theirs, not this site's.
AI-enhanced headshot used on the persona's portfolio card, cropped from the image in the cited GitLab report. GitLab reports that the operator generated it with AI headshot services from photographs the operator took, so it shows the operator, retouched.
Identifiers attributed to this persona
1 indicator the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Brian Young |
alias |
Brian Young
alias IT Worker Fraud RESEARCHER POST
Source
-
The persona of the operator in GitLab's fourth case study, a North Korean IT worker GitLab assesses was highly likely based in central Moscow when the photographs were taken on April 18, 2025, and who commonly reached GitLab.com from Russian IP addresses. The name appears only in the report's image of the operator's original and AI-enhanced photographs and the two profile pages that used them: a portfolio card reading "Brian Young, WebGL and Full Stack Developer" with a stated location of Kadoorie Hill, Hong Kong, and a "Meet the team" page captioned "Brian Young, Senior Full Stack Developer" with a LinkedIn icon. GitLab redacted both employers. GitLab reports that the operator began as a freelance developer and 3D modeler, was part of a 14-member cell in 2022, moved to seeking full-time employment at U.S. and U.K. organizations in 2025 through a facilitator in Hong Kong, presented as a Chinese national with visa difficulties to prospective facilitators, and gained employment with at least one small U.S. technology agency in mid-2025, with access to its client web hosts.
about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/ — GitLab Threat Intelligence
Sources
- about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/ — GitLab Threat Intelligence