erosyj

Also reported as: DIAMOND

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, erosyj. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2026-04-17

Identifiers attributed to this persona

5 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
DIAMOND alias —
kennerguo@gmail.com email address —
https://github.com/erosyj github profile live checked 2026-09-30
https://github.com/greengarden510 github profile removed checked 2026-09-30
https://github.com/xfika github profile removed checked 2026-09-30

DIAMOND

alias IT Worker Fraud RESEARCHER POST

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven states the account previously operated as GreenGarden510, now deleted, committed as DIAMOND under this address, and ran a second account, xfika, also deleted, so that a two-person collaboration on an Avalanche NFT marketplace was one operator using two accounts. Created 17 August 2021, one day before jusdy.
    x.com/meow_mfer/status/2045104494862889433 — meow mfer (@meow_mfer) · under “erosyj / DIAMOND” · published 2026-04-17 · pulled 2026-08-30

kennerguo@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven states the account previously operated as GreenGarden510, now deleted, committed as DIAMOND under this address, and ran a second account, xfika, also deleted, so that a two-person collaboration on an Avalanche NFT marketplace was one operator using two accounts. Created 17 August 2021, one day before jusdy.
    x.com/meow_mfer/status/2045108002836099351 — meow mfer (@meow_mfer) · under “erosyj / DIAMOND” · published 2026-04-17 · pulled 2026-08-30

https://github.com/erosyj

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven states the account previously operated as GreenGarden510, now deleted, committed as DIAMOND under this address, and ran a second account, xfika, also deleted, so that a two-person collaboration on an Avalanche NFT marketplace was one operator using two accounts. Created 17 August 2021, one day before jusdy.
    x.com/meow_mfer/status/2045108002836099351 — meow mfer (@meow_mfer) · under “erosyj / DIAMOND” · published 2026-04-17 · pulled 2026-08-30

https://github.com/greengarden510

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven states the account previously operated as GreenGarden510, now deleted, committed as DIAMOND under this address, and ran a second account, xfika, also deleted, so that a two-person collaboration on an Avalanche NFT marketplace was one operator using two accounts. Created 17 August 2021, one day before jusdy.
    x.com/meow_mfer/status/2045108306914726034 — meow mfer (@meow_mfer) · under “erosyj / DIAMOND” · published 2026-04-17 · pulled 2026-08-30

https://github.com/xfika

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven states the account previously operated as GreenGarden510, now deleted, committed as DIAMOND under this address, and ran a second account, xfika, also deleted, so that a two-person collaboration on an Avalanche NFT marketplace was one operator using two accounts. Created 17 August 2021, one day before jusdy.
    x.com/meow_mfer/status/2045108306914726034 — meow mfer (@meow_mfer) · under “erosyj / DIAMOND” · published 2026-04-17 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. erosyj as the name of the operator is the cited researcher’s assertion, repeated here as their claim.