devninja
Also reported as: Ninja
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, devninja. The attribution is theirs, not this site's.
The persona card the researcher published. The photograph is the one the identity presented and is not necessarily a picture of whoever operated it.
Identifiers attributed to this persona
3 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
devninja |
alias | |
Ninja |
alias | |
https://t.me/leonk0804 |
telegram account | live |
devninja
alias IT Worker Fraud RESEARCHER POST
Source
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "React & Blockchain & Ai Engineer" and links to Telegram and LinkedIn; only the Telegram account is named in the post.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies)
Ninja
alias IT Worker Fraud RESEARCHER POST
Source
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "React & Blockchain & Ai Engineer" and links to Telegram and LinkedIn; only the Telegram account is named in the post.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies)
https://t.me/leonk0804
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as leonk0804
live
Sources
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "React & Blockchain & Ai Engineer" and links to Telegram and LinkedIn; only the Telegram account is named in the post.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies) -
…https://x.com/browsercookies/status/1933591202550723029 -  #### Ninja - t.me/leonk0804 - https://x.com/browsercookies/status/1933591202550723029 -  #### 2401 - github.com/aimachieve -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies)