Jason Rostro
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Jason Rostro. The attribution is theirs, not this site's.
A still from a video call, published in the cited post, with the name the identity joined under shown in the corner of the frame. Unlike a profile picture this is whoever actually appeared on the call, which is the reason the post treats it as evidence.
Identifiers attributed to this persona
3 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Jason Rostro |
alias | |
jasoncallsrecruiters@gmail.com |
email address | |
+18146194286 |
phone number |
Jason Rostro
alias IT Worker Fraud RESEARCHER POST
Source
-
The address and telephone number are transcribed by hand from the second attached screenshot of the 19 April post, the contact block of a personal portfolio site. That post's own text describes the LinkedIn account as recently created with almost no post history, showing an employer while also open to work. The 18 April post is the same researcher publishing a still of the video call this identity appeared on, and carries no indicator of its own.
x.com/browsercookies/status/1913714980509331511 — Cookie Connoisseur (@browsercookies)
jasoncallsrecruiters@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The address and telephone number are transcribed by hand from the second attached screenshot of the 19 April post, the contact block of a personal portfolio site. That post's own text describes the LinkedIn account as recently created with almost no post history, showing an employer while also open to work. The 18 April post is the same researcher publishing a still of the video call this identity appeared on, and carries no indicator of its own.
x.com/browsercookies/status/1913714980509331511 — Cookie Connoisseur (@browsercookies)
+18146194286
phone number IT Worker Fraud RESEARCHER POST
Line type
| Line type | VoIP |
|---|---|
| Carrier | SKYPE COMMUNICATIONS |
| Rate centre | JOHNSTOWN, PA |
Source
-
The address and telephone number are transcribed by hand from the second attached screenshot of the 19 April post, the contact block of a personal portfolio site. That post's own text describes the LinkedIn account as recently created with almost no post history, showing an employer while also open to work. The 18 April post is the same researcher publishing a still of the video call this identity appeared on, and carries no indicator of its own.
x.com/browsercookies/status/1913714980509331511 — Cookie Connoisseur (@browsercookies)
Sources
- x.com/browsercookies/status/1913714980509331511 — Cookie Connoisseur (@browsercookies)