jusdy

Also reported as: Jusdy Joe

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, jusdy. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2026-04-17

Identifiers attributed to this persona

9 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
jusdy alias —
Jusdy Joe alias —
https://dev.to/jusdy devto account live checked 2026-11-08
https://hub.docker.com/u/jusdy dockerhub account live checked 2026-11-08
pauleta0126@gmail.com email address —
https://github.com/dylandev125 github profile removed checked 2026-09-30
https://github.com/jusdy github profile live checked 2026-09-30
https://gitlab.com/pauleta0126 gitlab account live checked 2026-11-08
https://huggingface.co/jusdy huggingface account live checked 2026-11-08

jusdy

alias IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- pauleta0126 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Gary. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/pauleta0126 — Chollima Hunter · under “jusdy” · pulled 2026-09-18

Jusdy Joe

alias IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Docker Hub whether an account exists under jusdy, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 1 July 2025 and a display name of Jusdy Joe. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/jusdy — Chollima Hunter · under “jusdy / Jusdy Joe” · pulled 2026-09-17

https://dev.to/jusdy

devto account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under jusdy, a login the index already carries for this persona on another platform. It gives a joined date of Oct 14, 2021. It displays the name jusdy, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    dev.to/jusdy — Chollima Hunter · under “jusdy” · pulled 2026-09-13

https://hub.docker.com/u/jusdy

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Docker Hub whether an account exists under jusdy, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 1 July 2025 and a display name of Jusdy Joe. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/jusdy — Chollima Hunter · under “jusdy / Jusdy Joe” · pulled 2026-09-17

pauleta0126@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2025-08-19 · last seen 2026-04-17

Sources

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. The thread names this account as the primary actor: 508 commits across five Tokamak repositories, committing as pauleta0126@gmail.com, previously the now-deleted dylandev125. Its following list is what the researcher used to enumerate the rest of the cell.
    x.com/meow_mfer/status/2045104864464945184 — meow mfer (@meow_mfer) · under “jusdy” · published 2026-04-17 · pulled 2026-08-30
  • Nearby text:

    …l.com passionatedev210@gmail.com passiondev0503@gmail.com passiondragon0413@gmail.com paul.krumme14163@gmail.com paul.richard66ds@gmail.com pauleta0126@gmail.com paullyons995@gmail.com paulwilstar1225@gmail.com pc19960926@gmail.com pegasusxnwn@gmail.com peppapig13132@gmail.com perfect.developer329@gm…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

https://github.com/dylandev125

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. The thread names this account as the primary actor: 508 commits across five Tokamak repositories, committing as pauleta0126@gmail.com, previously the now-deleted dylandev125. Its following list is what the researcher used to enumerate the rest of the cell.
    x.com/meow_mfer/status/2045104864464945184 — meow mfer (@meow_mfer) · under “jusdy” · published 2026-04-17 · pulled 2026-08-30

https://github.com/jusdy

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. The thread names this account as the primary actor: 508 commits across five Tokamak repositories, committing as pauleta0126@gmail.com, previously the now-deleted dylandev125. Its following list is what the researcher used to enumerate the rest of the cell.
    x.com/meow_mfer/status/2045104864464945184 — meow mfer (@meow_mfer) · under “jusdy” · published 2026-04-17 · pulled 2026-08-30

https://gitlab.com/pauleta0126

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- pauleta0126 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Gary. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/pauleta0126 — Chollima Hunter · under “jusdy” · pulled 2026-09-18

https://huggingface.co/jusdy

huggingface account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Hugging Face whether an account exists under jusdy, one of the logins the registry already holds for this operator, and read from the profile cited. The account states no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/jusdy — Chollima Hunter · under “jusdy” · pulled 2026-09-17

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. jusdy as the name of the operator is the cited researcher’s assertion, repeated here as their claim.