James McClung
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, James McClung. The attribution is theirs, not this site's.
Profiles and evidence
Portrait used by the persona; the same photograph is used by the linked identity Ondriah Young.
Identifiers attributed to this persona
2 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
James McClung |
alias | |
188.43.253.77 |
ip address |
James McClung
alias IT Worker Fraud RESEARCHER POST
Source
-
The researcher names this as the identity a DPRK IT worker interviews under, claiming Alvin, Texas, and reads the portrait as AI-generated. The post describes the name as a stolen identity, so somewhere there is a real person who carries it and is not accused of anything; it is recorded here because the name is what an interviewer is handed and the entry says plainly whose claim it is and that the identity is stolen. The operator connected from the same Russian address as a second identity the post names.
x.com/browsercookies/status/1913298431738888490 — Cookie Connoisseur (@browsercookies)
188.43.253.77
ip address IT Worker Fraud MATCHED IN SOURCE
Also listed under Ondriah Young — this value’s page names all of them.
Network
| Kind | fixed line |
|---|---|
| Network | TRANS-TELECOM |
| Announced by | AS20485 Joint Stock Company TransTeleCom |
| Country | Russia |
Sources
-
The researcher names this as the identity a DPRK IT worker interviews under, claiming Alvin, Texas, and reads the portrait as AI-generated. The post describes the name as a stolen identity, so somewhere there is a real person who carries it and is not accused of anything; it is recorded here because the name is what an interviewer is handed and the entry says plainly whose claim it is and that the identity is stolen. The operator connected from the same Russian address as a second identity the post names.
x.com/browsercookies/status/1913298431738888490 — Cookie Connoisseur (@browsercookies) -
The second identity the post names, described as an IT worker connecting from the same Russian address as the James McClung identity. That shared address is the whole of what links them and is the only value the post gives for this name.
x.com/browsercookies/status/1913298431738888490 — Cookie Connoisseur (@browsercookies) -
The researcher states that two IT-worker personas it was tracking connected from this same Russian address, which is what ties them to one another. The post attaches an AI-generated profile photograph and describes the identity behind it as stolen, so the name it gives is recorded in the held-back list rather than published as a persona here.
x.com/browsercookies/status/1913298431738888490 — Cookie Connoisseur (@browsercookies) -
…campaign; many are geo-located in Khabarovsk, Russia: 80.237.84.12 80.237.87.21 83.234.227.33-8 188.43.33.252 188.43.136.41,115 188.43.253.77 China Unicom ISP China remains North Korea’s most critical ally, providing political support, economic aid, and diplomatic backing.…
Threat Spotlight: Red Flags for Red Star Hackers: Hunting for North Korean Insiders - ReliaQuest — ReliaQuest
Sources
- Threat Spotlight: Red Flags for Red Star Hackers: Hunting for North Korean Insiders - ReliaQuest — ReliaQuest
- x.com/browsercookies/status/1913298431738888490 — Cookie Connoisseur (@browsercookies)