Cheng Lin

Also reported as: Patrick LinZhu Tai

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Cheng Lin. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-08-09 · last reported 2026-09-20

Identifiers attributed to this persona

10 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Cheng Lin alias —
Patrick Lin alias —
Zhu Tai alias —
https://hub.docker.com/u/temunel dockerhub account live checked 2026-11-08
patrickcoleman1129@outlook.com email address —
temunelp@gmail.com email address —
https://github.com/temunus github profile live checked 2026-09-30
https://medium.com/@temunel medium account not checked
https://x.com/chenglin1129 x account not checked
https://x.com/temunel x account not checked

Cheng Lin

alias IT Worker Fraud CURATED

First seen 2025-08-09 · last seen 2026-09-20

Sources

  • The thread's second named worker, X account temunel, formerly chenglin1129, with the GitHub account temunus and an earlier temunel account preserved only on the Wayback Machine. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/23219369/temunel, mastodon.social/@temunel, temunel.hashnode.dev/, temunus.github.io/, github.com/temunus/temunus.github.io, web.archive.org/web/20240913165501/https://temunel.github.io/, web.archive.org/web/20241001025412/https://github.com/temunel, web-cdn.bsky.app/profile/did:plc:bns5masj5rbtdm5u2tbzq42q.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Cheng Lin / Patrick Lin / Zhu Tai” · published 2025-08-09 · pulled 2026-08-30
  • Found on 17 September 2026 by asking Docker Hub whether an account exists under temunel, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 29 April 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/temunel — Chollima Hunter · under “Cheng Lin” · pulled 2026-09-17
  • Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/temunus, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: patrickcoleman1129@outlook.com authored 17 commits across 4 of its repositories, commits as "temunus". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
    github.com/temunus — Chollima Hunter · under “Cheng Lin” · pulled 2026-09-20

Patrick Lin

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • The thread's second named worker, X account temunel, formerly chenglin1129, with the GitHub account temunus and an earlier temunel account preserved only on the Wayback Machine. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/23219369/temunel, mastodon.social/@temunel, temunel.hashnode.dev/, temunus.github.io/, github.com/temunus/temunus.github.io, web.archive.org/web/20240913165501/https://temunel.github.io/, web.archive.org/web/20241001025412/https://github.com/temunel, web-cdn.bsky.app/profile/did:plc:bns5masj5rbtdm5u2tbzq42q.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Cheng Lin / Patrick Lin / Zhu Tai” · published 2025-08-09 · pulled 2026-08-30

Zhu Tai

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • The thread's second named worker, X account temunel, formerly chenglin1129, with the GitHub account temunus and an earlier temunel account preserved only on the Wayback Machine. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/23219369/temunel, mastodon.social/@temunel, temunel.hashnode.dev/, temunus.github.io/, github.com/temunus/temunus.github.io, web.archive.org/web/20240913165501/https://temunel.github.io/, web.archive.org/web/20241001025412/https://github.com/temunel, web-cdn.bsky.app/profile/did:plc:bns5masj5rbtdm5u2tbzq42q.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Cheng Lin / Patrick Lin / Zhu Tai” · published 2025-08-09 · pulled 2026-08-30

https://hub.docker.com/u/temunel

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Docker Hub whether an account exists under temunel, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 29 April 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/temunel — Chollima Hunter · under “Cheng Lin” · pulled 2026-09-17

patrickcoleman1129@outlook.com

email address IT Worker Fraud CURATED

First seen 2026-09-20 · last seen 2026-09-20

Source

  • Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/temunus, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: patrickcoleman1129@outlook.com authored 17 commits across 4 of its repositories, commits as "temunus". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
    github.com/temunus — Chollima Hunter · under “Cheng Lin” · pulled 2026-09-20

temunelp@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • The thread's second named worker, X account temunel, formerly chenglin1129, with the GitHub account temunus and an earlier temunel account preserved only on the Wayback Machine. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/23219369/temunel, mastodon.social/@temunel, temunel.hashnode.dev/, temunus.github.io/, github.com/temunus/temunus.github.io, web.archive.org/web/20240913165501/https://temunel.github.io/, web.archive.org/web/20241001025412/https://github.com/temunel, web-cdn.bsky.app/profile/did:plc:bns5masj5rbtdm5u2tbzq42q.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Cheng Lin / Patrick Lin / Zhu Tai” · published 2025-08-09 · pulled 2026-08-30

https://github.com/temunus

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2025-08-09 · last seen 2025-08-09

Source

  • The thread's second named worker, X account temunel, formerly chenglin1129, with the GitHub account temunus and an earlier temunel account preserved only on the Wayback Machine. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/23219369/temunel, mastodon.social/@temunel, temunel.hashnode.dev/, temunus.github.io/, github.com/temunus/temunus.github.io, web.archive.org/web/20240913165501/https://temunel.github.io/, web.archive.org/web/20241001025412/https://github.com/temunel, web-cdn.bsky.app/profile/did:plc:bns5masj5rbtdm5u2tbzq42q.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Cheng Lin / Patrick Lin / Zhu Tai” · published 2025-08-09 · pulled 2026-08-30

https://medium.com/@temunel

medium account IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • The thread's second named worker, X account temunel, formerly chenglin1129, with the GitHub account temunus and an earlier temunel account preserved only on the Wayback Machine. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/23219369/temunel, mastodon.social/@temunel, temunel.hashnode.dev/, temunus.github.io/, github.com/temunus/temunus.github.io, web.archive.org/web/20240913165501/https://temunel.github.io/, web.archive.org/web/20241001025412/https://github.com/temunel, web-cdn.bsky.app/profile/did:plc:bns5masj5rbtdm5u2tbzq42q.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Cheng Lin / Patrick Lin / Zhu Tai” · published 2025-08-09 · pulled 2026-08-30

https://x.com/chenglin1129

x account IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • The thread's second named worker, X account temunel, formerly chenglin1129, with the GitHub account temunus and an earlier temunel account preserved only on the Wayback Machine. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/23219369/temunel, mastodon.social/@temunel, temunel.hashnode.dev/, temunus.github.io/, github.com/temunus/temunus.github.io, web.archive.org/web/20240913165501/https://temunel.github.io/, web.archive.org/web/20241001025412/https://github.com/temunel, web-cdn.bsky.app/profile/did:plc:bns5masj5rbtdm5u2tbzq42q.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Cheng Lin / Patrick Lin / Zhu Tai” · published 2025-08-09 · pulled 2026-08-30

https://x.com/temunel

x account IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • The thread's second named worker, X account temunel, formerly chenglin1129, with the GitHub account temunus and an earlier temunel account preserved only on the Wayback Machine. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/23219369/temunel, mastodon.social/@temunel, temunel.hashnode.dev/, temunus.github.io/, github.com/temunus/temunus.github.io, web.archive.org/web/20240913165501/https://temunel.github.io/, web.archive.org/web/20241001025412/https://github.com/temunel, web-cdn.bsky.app/profile/did:plc:bns5masj5rbtdm5u2tbzq42q.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Cheng Lin / Patrick Lin / Zhu Tai” · published 2025-08-09 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Cheng Lin as the name of the operator is the cited researcher’s assertion, repeated here as their claim.