Dejan Teofilovic
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Dejan Teofilovic. The attribution is theirs, not this site's.
LinkedIn accounts
https://www.linkedin.com/in/dejan-teofilovic/
removed
linkedin profile IT Worker Fraud RESEARCHER POST removed
Source
-
One post listing three names together with a single pool of addresses, phone numbers, accounts and portfolio sites, under the heading the researcher gives it. The post does not say which value belongs to which name, and it does not say the three are one operator, so only the values that name a person themselves are attributed. Everything else is recorded as a group. Independently, Group-IB's research on a reusable persona shell it tracks as cybersage14 names Dejan-Teofilovic as an identity that account shifted to, and the GitHub account under that name was already indexed from that report; this post is a second, separate citation for it.
x.com/meow_mfer/status/1929659508428886218 — meow mfer (@meow_mfer)
Identifiers reported alongside
2 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Dejan Teofilovic |
alias | |
https://github.com/dejan-teofilovic |
github profile | removed |
Dejan Teofilovic
alias IT Worker Fraud RESEARCHER POST
Source
-
One post listing three names together with a single pool of addresses, phone numbers, accounts and portfolio sites, under the heading the researcher gives it. The post does not say which value belongs to which name, and it does not say the three are one operator, so only the values that name a person themselves are attributed. Everything else is recorded as a group. Independently, Group-IB's research on a reusable persona shell it tracks as cybersage14 names Dejan-Teofilovic as an identity that account shifted to, and the GitHub account under that name was already indexed from that report; this post is a second, separate citation for it.
x.com/meow_mfer/status/1929659508428886218 — meow mfer (@meow_mfer)
https://github.com/dejan-teofilovic
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as dejan-teofilovic
removed
Sources
-
One post listing three names together with a single pool of addresses, phone numbers, accounts and portfolio sites, under the heading the researcher gives it. The post does not say which value belongs to which name, and it does not say the three are one operator, so only the values that name a person themselves are attributed. Everything else is recorded as a group. Independently, Group-IB's research on a reusable persona shell it tracks as cybersage14 names Dejan-Teofilovic as an identity that account shifted to, and the GitHub account under that name was already indexed from that report; this post is a second, separate citation for it.
x.com/meow_mfer/status/1929659508428886218 — meow mfer (@meow_mfer) -
…master https://github.com/caddo229 https://github.com/caddoSmith229 https://github.com/chase-allen-tech https://github.com/cybersage14 https://github.com/Dejan-Teofilovic https://github.com/deterrionc https://github.com/devking877 https://github.com/fantasy1114 https://github.com/freshtinygrow-crypto htt…
Cyber Saga: In the Footsteps of the DPRK IT Workers | Group-IB Blog — Group-IB
Sources
- Cyber Saga: In the Footsteps of the DPRK IT Workers | Group-IB Blog — Group-IB
- x.com/meow_mfer/status/1929659508428886218 — meow mfer (@meow_mfer)