John Alexander Bird
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, John Alexander Bird. The attribution is theirs, not this site's.
Nisos's network map of the four personas, published as Graphic 1 of the cited report, is where this face comes from; it is the image the map shows for this persona, and not necessarily a photograph of the person operating it. The map's lines record which GitHub account, address or Telegram handle Nisos found each persona using directly and which it found only on GitHub commits.
Identifiers attributed to this persona
2 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
John Alexander Bird |
alias | |
https://github.com/imcode65 |
github profile | removed |
John Alexander Bird
alias IT Worker Fraud RESEARCHER POST
Source
-
Nisos reports that this persona's resume was created and updated in 2024 through the GitHub account imcode65, that the account is associated with the address kanbei0605@gmail.com also used by Karl Chong, and that the persona had no active personal website when the report was written, which Nisos reads as a persona not yet seeking employment. The network map ties it to imcode65 through commits.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos
https://github.com/imcode65
github profile IT Worker Fraud RESEARCHER POST removed
Also listed under Ram Maharjan, Roman Kryveha — this value’s page names all of them.
removed
Sources
-
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's text says this persona reused Karl Chong's about-me paragraph and stock photograph; its network map draws a direct line from the persona to the GitHub account kanbei0605 and a commit-derived line to imcode65. Both accounts are carried here as Nisos's attribution, and a line found on commits is a weaker tie than a direct one.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's network map ties this persona to the GitHub accounts code-0605 and imcode65 through commits rather than through a direct connection, which is the weaker of the two ties the map draws; the text gives no further detail on this persona.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
Nisos reports that this persona's resume was created and updated in 2024 through the GitHub account imcode65, that the account is associated with the address kanbei0605@gmail.com also used by Karl Chong, and that the persona had no active personal website when the report was written, which Nisos reads as a persona not yet seeking employment. The network map ties it to imcode65 through commits.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos