Chollima Hunter

← All personas

Dream

Also reported as: Lucas LiMarkus LaanShan Shan FengHasibullah NaaseriCharlie WangAndrii SokyrkaBo ZhangRoberto Di Fiore

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Dream. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-08-13

Profiles and evidence

LinkedIn accounts

Identifiers reported alongside

21 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Andrii Sokyrka alias —
Bo Zhang alias —
Charlie Wang alias —
Dream alias —
Hasibullah Naaseri alias —
Lucas Li alias —
Markus Laan alias —
Roberto Di Fiore alias —
Shan Shan Feng alias —
https://hub.docker.com/u/lucenera75 dockerhub account live checked 2026-11-08
andriisokyrka@gmail.com email address —
charliewang1218917.dream@proton.me email address —
dreamitdev1218917@gmail.com email address —
hasibullahnasseri986@gmail.com email address —
lucaslidream1218917@gmail.com email address —
markuslaandream1218917@gmail.com email address —
robertodifiore75@gmail.com email address —
shanshaneth1994@gmail.com email address —
https://github.com/intellltech github profile live checked 2026-09-02
https://github.com/lucenera75 github profile live checked 2026-09-02
https://gitlab.com/robertodifiore75 gitlab account not checked

Andrii Sokyrka

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-13 · last seen 2025-08-13

Source

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

Bo Zhang

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-13 · last seen 2025-08-13

Source

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

Charlie Wang

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-13 · last seen 2025-08-13

Source

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

Dream

alias IT Worker Fraud CURATED

First seen 2025-08-13 · last seen 2025-08-13

Sources

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30
  • Found on 17 September 2026 by asking Docker Hub whether an account exists under lucenera75, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 4 September 2018. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/lucenera75 — Chollima Hunter · under “Dream” · pulled 2026-09-17
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- robertodifiore75 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of roberto di fiore. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/robertodifiore75 — Chollima Hunter · under “Dream / Roberto Di Fiore” · pulled 2026-09-18

Hasibullah Naaseri

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-13 · last seen 2025-08-13

Source

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

Lucas Li

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-13 · last seen 2025-08-13

Source

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

Markus Laan

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-13 · last seen 2025-08-13

Source

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

Roberto Di Fiore

alias IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- robertodifiore75 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of roberto di fiore. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/robertodifiore75 — Chollima Hunter · under “Dream / Roberto Di Fiore” · pulled 2026-09-18

Shan Shan Feng

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-13 · last seen 2025-08-13

Source

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

https://hub.docker.com/u/lucenera75

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Docker Hub whether an account exists under lucenera75, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 4 September 2018. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/lucenera75 — Chollima Hunter · under “Dream” · pulled 2026-09-17

andriisokyrka@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2025-08-13 · last seen 2025-08-19

Sources

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

  • Nearby text:

    …h1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding this, you can read the…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

charliewang1218917.dream@proton.me

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2025-08-13 · last seen 2025-08-19

Sources

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

  • Nearby text:

    …om kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

dreamitdev1218917@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

Listed as dreamit.dev1218917@gmail.com

First seen 2025-08-13 · last seen 2025-08-19

Sources

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

  • Nearby text:

    …e.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding this, you can read the following articles to get a…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

hasibullahnasseri986@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2025-08-13 · last seen 2025-08-19

Sources

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

  • Nearby text:

    …om lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

lucaslidream1218917@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

Listed as lucasli.dream1218917@gmail.com

First seen 2025-08-13 · last seen 2025-08-19

Sources

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

  • Nearby text:

    …martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com Ch…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

markuslaandream1218917@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2025-08-13 · last seen 2025-08-19

Sources

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

  • Nearby text:

    …iacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gm…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

robertodifiore75@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-08-13 · last seen 2025-08-13

Source

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

shanshaneth1994@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

Listed as shan.shan.eth1994@gmail.com

First seen 2025-08-13 · last seen 2025-08-19

Sources

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

  • Nearby text:

    …m kevin.tsang.coder@gmail.com henry.zhang@gmail.com viacheslay.zadorozhnyi3863@gmail.com lucasli.dream1218917@gmail.com kenjitamm@gmail.com shan.shan.eth1994@gmail.com daniellee.dev1@gmail.com markuslaandream1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@g…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

https://github.com/intellltech

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

Also listed under Tiger — this value’s page names all of them.

First seen 2025-08-13 · last seen 2025-08-13

Sources

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Henry Zhang row under this team and once on the Shan Shan Feng row under Dream, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Tiger / Joshua Gosney / Hung Pham / Henry Zhang / Jack Mazur / Maksym Martynenko / Daniel Ho” · published 2025-08-13 · pulled 2026-08-30
  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

https://github.com/lucenera75

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-08-13 · last seen 2025-08-13

Source

  • ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here. One value in the table is shared with another team. The GitHub account github.com/intellltech is listed twice in the image, once on the Shan Shan Feng row under this team and once on the Henry Zhang row under Tiger, spelled identically in both. It is recorded against both operators because that is what the source shows; it is not a transcription error here, and it is the only value in the table that appears under two teams. The address robertodifiore75@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) · under “Dream / Lucas Li / Markus Laan / Shan Shan Feng / Hasibullah Naaseri / Charlie Wang / Andrii Sokyrka / Bo Zhang” · published 2025-08-13 · pulled 2026-08-30

https://gitlab.com/robertodifiore75

gitlab account IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- robertodifiore75 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of roberto di fiore. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/robertodifiore75 — Chollima Hunter · under “Dream / Roberto Di Fiore” · pulled 2026-09-18

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Dream as the name of the operator is the cited researcher’s assertion, repeated here as their claim.