Darius Wilson-Prince

Confirmed by Chollima Hunter research and rated medium confidence; corroborated by i3 Threat Advisory: email indicator appendix, DTEX Systems. Chollima Hunter research pairs the name Darius Wilson-Prince with dariusprince.net@gmail.com and dariusprince90@gmail.com. The first is the same Gmail mailbox as dariusprincenet@gmail.com, because Gmail ignores dots, and that address is in DTEX's i3 Threat Advisory email-indicator appendix, which this site already indexes; DTEX notes that the appendix is not by itself proof of attribution. The second address is the commit author on repositories of the GitHub account prince0409 (created March 2023, display name Prince), whose repositories include several that are named as take-home coding exercises (bhe-code-exercise, patient-matcher, freight-delay, sunvoy) beside a BC.Game browser extension and a wallet project. The torre.ai profile, read on 3 October 2026, presents a front-end engineer in Columbia, South Carolina with over ten years of experience: Jeenie from 2019 to 2023, Softpath System LLC from 2014 to 2019 and Tropic from 2011 to 2014, none of it verified on the platform. That history may be borrowed from a real person, and nothing here names one.

Confirmed by Chollima Hunter research and rated medium confidence; corroborated by i3 Threat Advisory: email indicator appendix, DTEX Systems. Chollima Hunter research pairs the name Darius Wilson-Prince with dariusprince.net@gmail.com and dariusprince90@gmail.com. The first is the same Gmail mailbox as dariusprincenet@gmail.com, because Gmail ignores dots, and that address is in DTEX's i3 Threat Advisory email-indicator appendix, which this site already indexes; DTEX notes that the appendix is not by itself proof of attribution. The second address is the commit author on repositories of the GitHub account prince0409 (created March 2023, display name Prince), whose repositories include several that are named as take-home coding exercises (bhe-code-exercise, patient-matcher, freight-delay, sunvoy) beside a BC.Game browser extension and a wallet project. The torre.ai profile, read on 3 October 2026, presents a front-end engineer in Columbia, South Carolina with over ten years of experience: Jeenie from 2019 to 2023, Softpath System LLC from 2014 to 2019 and Tropic from 2011 to 2014, none of it verified on the platform. That history may be borrowed from a real person, and nothing here names one.

Per DTEX's own advisory text: these IOCs are NOT indicative of a confirmed North-Korea-attributed hack — they may have associations with IT-worker operations and require further investigation if observed in your environment. Any connection to actual persons may be deliberate (an operator using a real person's identity) or incidental, and the actual owner of an email account listed here may be unaware their address is associated with this IOC list. Do not treat presence on this list as proof of wrongdoing by the account holder.

Confirmed by Chollima Hunter research and rated medium confidence; corroborated by i3 Threat Advisory: email indicator appendix, DTEX Systems. Chollima Hunter research pairs the name Darius Wilson-Prince with dariusprince.net@gmail.com and dariusprince90@gmail.com. The first is the same Gmail mailbox as dariusprincenet@gmail.com, because Gmail ignores dots, and that address is in DTEX's i3 Threat Advisory email-indicator appendix, which this site already indexes; DTEX notes that the appendix is not by itself proof of attribution. The second address is the commit author on repositories of the GitHub account prince0409 (created March 2023, display name Prince), whose repositories include several that are named as take-home coding exercises (bhe-code-exercise, patient-matcher, freight-delay, sunvoy) beside a BC.Game browser extension and a wallet project. The torre.ai profile, read on 3 October 2026, presents a front-end engineer in Columbia, South Carolina with over ten years of experience: Jeenie from 2019 to 2023, Softpath System LLC from 2014 to 2019 and Tropic from 2011 to 2014, none of it verified on the platform. That history may be borrowed from a real person, and nothing here names one.

Confirmed by Chollima Hunter research and rated medium confidence; corroborated by i3 Threat Advisory: email indicator appendix, DTEX Systems. Chollima Hunter research pairs the name Darius Wilson-Prince with dariusprince.net@gmail.com and dariusprince90@gmail.com. The first is the same Gmail mailbox as dariusprincenet@gmail.com, because Gmail ignores dots, and that address is in DTEX's i3 Threat Advisory email-indicator appendix, which this site already indexes; DTEX notes that the appendix is not by itself proof of attribution. The second address is the commit author on repositories of the GitHub account prince0409 (created March 2023, display name Prince), whose repositories include several that are named as take-home coding exercises (bhe-code-exercise, patient-matcher, freight-delay, sunvoy) beside a BC.Game browser extension and a wallet project. The torre.ai profile, read on 3 October 2026, presents a front-end engineer in Columbia, South Carolina with over ten years of experience: Jeenie from 2019 to 2023, Softpath System LLC from 2014 to 2019 and Tropic from 2011 to 2014, none of it verified on the platform. That history may be borrowed from a real person, and nothing here names one.