Joy Huang
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Joy Huang. The attribution is theirs, not this site's.
LinkedIn accounts
https://www.linkedin.com/in/erik-huang-full-stack/
linkedin profile IT Worker Fraud RESEARCHER POST
Source
-
Hayden McKenzie's report names Joy (Joey) as the other operative placed at the same consultancy through MageHire, listed in Shenyang, with a client address beginning joy.huang@ (domain withheld). A GitHub account named Joy, maxvmiracle, follows only MageHire's company account and is followed back; see the MageHire indicators. A Slack screenshot the report publishes shows MageHire's CEO giving the client linkedin.com/in/erik-huang-full-stack as Joy's LinkedIn.
haydenmckenzie.com/research/dprk-it-worker-cell-part-one — Hayden McKenzie
Identifiers reported alongside
1 indicator the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Joy Huang |
alias |
Joy Huang
alias IT Worker Fraud RESEARCHER POST
Source
-
Hayden McKenzie's report names Joy (Joey) as the other operative placed at the same consultancy through MageHire, listed in Shenyang, with a client address beginning joy.huang@ (domain withheld). A GitHub account named Joy, maxvmiracle, follows only MageHire's company account and is followed back; see the MageHire indicators. A Slack screenshot the report publishes shows MageHire's CEO giving the client linkedin.com/in/erik-huang-full-stack as Joy's LinkedIn.
haydenmckenzie.com/research/dprk-it-worker-cell-part-one — Hayden McKenzie
Sources
- haydenmckenzie.com/research/dprk-it-worker-cell-part-one — Hayden McKenzie