Jaron Gaston
Also reported as: Awesome7CodeWizard
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Jaron Gaston. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Portrait published in the cited post, a studio headshot of the kind these identities routinely take from an uninvolved person. It shows the image the identity presented as itself and is not necessarily a photograph of the person operating it.
LinkedIn accounts
https://www.linkedin.com/in/jaron-gaston-7a16a9322/
removed
linkedin profile IT Worker Fraud RESEARCHER POST removed
Source
-
One post listing three names together with a single pool of addresses, phone numbers, accounts and portfolio sites, under the heading the researcher gives it. The post does not say which value belongs to which name, and it does not say the three are one operator, so only the values that name a person themselves are attributed. Everything else is recorded as a group. Independently, Group-IB's research on a reusable persona shell it tracks as cybersage14 names Dejan-Teofilovic as an identity that account shifted to, and the GitHub account under that name was already indexed from that report; this post is a second, separate citation for it.
x.com/meow_mfer/status/1929659508428886218 — meow mfer (@meow_mfer)
Identifiers reported alongside
5 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Awesome |
alias | |
Jaron Gaston |
alias | |
https://calendly.com/7codewizard |
calendly account | |
https://dev.to/7codewizard |
devto account | live |
https://github.com/7codewizard |
github profile | removed |
Awesome
alias IT Worker Fraud RESEARCHER POST
Source
-
The GitHub account is read by hand from the third attached screenshot, a profile page headed Awesome with the handle 7CodeWizard, 73 repositories and 1.2k followers, and from a second capture of a bare profile card reading Jaron Gaston with no followers. This entry is browsercookies writing about the same name meow_mfer wrote about separately in June 2025. The two citations are independent, and the site groups them under one persona because they name the same identity.
x.com/browsercookies/status/1913730114661372362 — Cookie Connoisseur (@browsercookies)
Jaron Gaston
alias IT Worker Fraud CURATED
Sources
-
One post listing three names together with a single pool of addresses, phone numbers, accounts and portfolio sites, under the heading the researcher gives it. The post does not say which value belongs to which name, and it does not say the three are one operator, so only the values that name a person themselves are attributed. Everything else is recorded as a group. Independently, Group-IB's research on a reusable persona shell it tracks as cybersage14 names Dejan-Teofilovic as an identity that account shifted to, and the GitHub account under that name was already indexed from that report; this post is a second, separate citation for it.
x.com/meow_mfer/status/1929659508428886218 — meow mfer (@meow_mfer) -
The GitHub account is read by hand from the third attached screenshot, a profile page headed Awesome with the handle 7CodeWizard, 73 repositories and 1.2k followers, and from a second capture of a bare profile card reading Jaron Gaston with no followers. This entry is browsercookies writing about the same name meow_mfer wrote about separately in June 2025. The two citations are independent, and the site groups them under one persona because they name the same identity.
x.com/browsercookies/status/1913730114661372362 — Cookie Connoisseur (@browsercookies) -
The Calendly page Heiner García's report of 24 June 2025 gives for the 7CodeWizard account.
www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html — Heiner García -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under 7codewizard, a login the index already carries for this persona on another platform. It gives a joined date of Jul 9, 2024. It displays the name Jaron Gaston, the same name the reporting already gives. It gives a location of Murphysboro, IL, USA. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/7codewizard — Chollima Hunter
https://calendly.com/7codewizard
calendly account IT Worker Fraud MATCHED IN SOURCE
Listed as 7codewizard
Sources
-
The Calendly page Heiner García's report of 24 June 2025 gives for the 7CodeWizard account.
www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html — Heiner García -
…URL:https://github.com/neymafullstack URL:https://github.com/swiftcode1121 URL:https://github.com/ghost URL:https://calendly.com/7codewizard/30min URL:https://jackson-portfolio.vercel.app URL:https://www.linkedin.com/in/jackson-kidd-1680b2339/…
How We Caught Lazarus's IT Workers Scheme Live on Camera — ANY.RUN -
…The notable difference is that this second message includes a Calendly scheduling link: https://calendly.com/7codewizard/30min - instructing the recipient to schedule a meeting Figure 24: Calendly 7codewizard already reported:…
The GitHub Diaries of DPRK IT Workers — North Scan -
…Email Addresses: truepartner312@gmail.com motosimasuo@gmail.com jacksummers0822@gmail.com Calendly url: https://calendly.com/7codewizard/30min https://calendly.com/davidcolman002/30min Wallet Address: 14iULn6TYRmawsxazqR2xwWVuyDXc8ycGjg7ppJ15qVKctEN (Used in the…
Understanding DPRK IT Worker Activity - Conversations and Insights - Ketman - Threat intelligence for remote and open source organizations — ketman.org
https://dev.to/7codewizard
devto account IT Worker Fraud CURATED live
live
Source
-
Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under 7codewizard, a login the index already carries for this persona on another platform. It gives a joined date of Jul 9, 2024. It displays the name Jaron Gaston, the same name the reporting already gives. It gives a location of Murphysboro, IL, USA. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/7codewizard — Chollima Hunter
https://github.com/7codewizard
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as 7codewizard
removed
Sources
-
The GitHub account is read by hand from the third attached screenshot, a profile page headed Awesome with the handle 7CodeWizard, 73 repositories and 1.2k followers, and from a second capture of a bare profile card reading Jaron Gaston with no followers. This entry is browsercookies writing about the same name meow_mfer wrote about separately in June 2025. The two citations are independent, and the site groups them under one persona because they name the same identity.
x.com/browsercookies/status/1913730114661372362 — Cookie Connoisseur (@browsercookies) -
…(IOCs) GitHub Accounts: github.com/motokimasuo github.com/bestselection18 github.com/kirbyAttack github.com/swiftcode1121 github.com/7CodeWizard Email Addresses: truepartner312@gmail.com motosimasuo@gmail.com jacksummers0822@gmail.com Calendly url:…
Understanding DPRK IT Worker Activity - Conversations and Insights - Ketman - Threat intelligence for remote and open source organizations — ketman.org -
…of Compromise IPv4:194.33.45.162 URL:https://t.me/peregrine423f URL:aaronzeeshan.slack.com URL:aaronsfazzy.slack.com URL:https://github.com/7codewizard URL:https://github.com/neymafullstack URL:https://github.com/swiftcode1121 URL:https://github.com/ghost…
How We Caught Lazarus's IT Workers Scheme Live on Camera — ANY.RUN -
…b.com/buddy0323/bright0220 URL:https//github.com/bright0220 URL:https//github.com/ghost URL:https//github.com/NeymaFullStack URL:https//github.com/7codewizard URL:https//calendly.com/7codewizard/30min URL:https//github.com/anupam-tiwari/productivity_tracker/issues/1 URL:https//github.com/typesc…
The GitHub Diaries of DPRK IT Workers — North Scan
Sources
- How We Caught Lazarus's IT Workers Scheme Live on Camera — ANY.RUN
- The GitHub Diaries of DPRK IT Workers — North Scan
- Understanding DPRK IT Worker Activity - Conversations and Insights - Ketman - Threat intelligence for remote and open source organizations — ketman.org
- x.com/meow_mfer/status/1929659508428886218 — meow mfer (@meow_mfer)
- x.com/browsercookies/status/1913730114661372362 — Cookie Connoisseur (@browsercookies)
- dev.to/7codewizard — Chollima Hunter