Josh Mack
Also reported as: Rossryuli
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Josh Mack. The attribution is theirs, not this site's.
Portrait used by the persona on a developer portfolio.
Identifiers attributed to this persona
4 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Josh Mack |
alias | |
mjoshalchi@gmail.com |
email address | |
https://github.com/rossryuli |
github profile | live |
188.43.136.41 |
ip address |
Josh Mack
alias IT Worker Fraud RESEARCHER POST
Source
-
The post asserts one identity outright, that Josh Mack and the GitHub account rossryuli are the same. The rest it states as links rather than equivalences: Kanbei is linked to mjoshalchi@gmail.com, and that address to rossryuli. The IP address is given as Russian and appears in the post immediately after the rossryuli line. The researcher writes the address without a top-level domain, as mjoshalchi[@]gmail.
x.com/browsercookies/status/1914447750445588965 — Cookie Connoisseur (@browsercookies)
mjoshalchi@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The post asserts one identity outright, that Josh Mack and the GitHub account rossryuli are the same. The rest it states as links rather than equivalences: Kanbei is linked to mjoshalchi@gmail.com, and that address to rossryuli. The IP address is given as Russian and appears in the post immediately after the rossryuli line. The researcher writes the address without a top-level domain, as mjoshalchi[@]gmail.
x.com/browsercookies/status/1914447750445588965 — Cookie Connoisseur (@browsercookies)
https://github.com/rossryuli
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The post asserts one identity outright, that Josh Mack and the GitHub account rossryuli are the same. The rest it states as links rather than equivalences: Kanbei is linked to mjoshalchi@gmail.com, and that address to rossryuli. The IP address is given as Russian and appears in the post immediately after the rossryuli line. The researcher writes the address without a top-level domain, as mjoshalchi[@]gmail.
x.com/browsercookies/status/1914447750445588965 — Cookie Connoisseur (@browsercookies)
188.43.136.41
ip address IT Worker Fraud MATCHED IN SOURCE
Network
| Kind | fixed line |
|---|---|
| Network | TRANS-TELECOM |
| Announced by | AS20485 Joint Stock Company TransTeleCom |
| Country | Russia |
Sources
-
The post asserts one identity outright, that Josh Mack and the GitHub account rossryuli are the same. The rest it states as links rather than equivalences: Kanbei is linked to mjoshalchi@gmail.com, and that address to rossryuli. The IP address is given as Russian and appears in the post immediately after the rossryuli line. The researcher writes the address without a top-level domain, as mjoshalchi[@]gmail.
x.com/browsercookies/status/1914447750445588965 — Cookie Connoisseur (@browsercookies) -
…associated with this campaign; many are geo-located in Khabarovsk, Russia: 80.237.84.12 80.237.87.21 83.234.227.33-8 188.43.33.252 188.43.136.41,115 188.43.253.77 China Unicom ISP China remains North Korea’s most critical ally, providing political support, economic aid, and…
Threat Spotlight: Red Flags for Red Star Hackers: Hunting for North Korean Insiders - ReliaQuest — ReliaQuest
Sources
- Threat Spotlight: Red Flags for Red Star Hackers: Hunting for North Korean Insiders - ReliaQuest — ReliaQuest
- x.com/browsercookies/status/1914447750445588965 — Cookie Connoisseur (@browsercookies)