Chollima Hunter

← All personas

Karl Chong

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Karl Chong. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-03-27 · last reported 2026-09-29

Profiles and evidence

Identifiers attributed to this persona

12 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Karl Chong alias —
https://discord.com/users/979573814990078022 discord account not checked
kanbei0605@gmail.com email address —
https://github.com/code-0605 github profile removed checked 2026-09-18
https://github.com/kanbei0605 github profile live checked 2026-09-18
https://github.com/kanbei65 github profile live checked 2026-09-30
https://github.com/superredstar github profile removed checked 2026-09-18
https://laborx.com/freelancers/users/id100369 laborx account live checked 2026-11-08
https://remotehub.com/karl.chong remotehub account not checked
https://remoteok.com/@karlchong remoteok account live checked 2026-11-08
https://t.me/kanbei0605 telegram account live checked 2026-11-08
https://xing.com/profile/karl_chong xing account live checked 2026-11-08

Karl Chong

alias IT Worker Fraud CURATED

First seen 2025-03-27 · last seen 2026-09-29

Sources

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/kanbei65 is account id 91700749, created on 30 September 2021. 79 of its 100 own commits are signed kanbei0605@gmail.com and the other 21 with a noreply address under the handle kanbei0605, so this account was once named kanbei0605. Nisos names github.com/kanbei0605 under Karl Chong. That handle now belongs to a different account, id 116683582, created on 25 October 2022, which is not this one; which of the two Nisos read cannot be settled from the handle, but the address kanbei0605@gmail.com, which the same reporting gives for the persona, signs this account's commits.
    github.com/kanbei65 — Chollima Hunter · under “Karl Chong” · pulled 2026-09-24
  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (kanbei0605) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/kanbei65/code-0605/blob/81f4cb1f433d5149ef781ad6820341983b0cab42/README.md — Chollima Hunter · under “Karl Chong” · published 2024-03-07 · pulled 2026-09-29

https://discord.com/users/979573814990078022

discord account IT Worker Fraud CURATED

First seen 2026-09-29 · last seen 2026-09-29

Source

  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (kanbei0605) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/kanbei65/code-0605/blob/81f4cb1f433d5149ef781ad6820341983b0cab42/README.md — Chollima Hunter · under “Karl Chong” · published 2024-03-07 · pulled 2026-09-29

kanbei0605@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-03-27 · last seen 2026-09-24

Sources

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/kanbei65 is account id 91700749, created on 30 September 2021. 79 of its 100 own commits are signed kanbei0605@gmail.com and the other 21 with a noreply address under the handle kanbei0605, so this account was once named kanbei0605. Nisos names github.com/kanbei0605 under Karl Chong. That handle now belongs to a different account, id 116683582, created on 25 October 2022, which is not this one; which of the two Nisos read cannot be settled from the handle, but the address kanbei0605@gmail.com, which the same reporting gives for the persona, signs this account's commits.
    github.com/kanbei65 — Chollima Hunter · under “Karl Chong” · pulled 2026-09-24

  • Nearby text:

    …n6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuh…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01
  • …The account is associated with the email address kanbei0605@gmail.com, which is also associated with the persona Karl Chong. Graphic 1: Network map of likely DPRK-affiliated…
    DPRK IT Worker Scam: Mitigation Steps for Hiring Teams — Nisos · under “Fake Persona Network” · published 2025-03-27 · pulled 2026-09-18

https://github.com/code-0605

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-18

Also listed under Ram Maharjan — this value’s page names all of them.

First seen 2025-03-27 · last seen 2025-03-27

Sources

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18
  • One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's network map ties this persona to the GitHub accounts code-0605 and imcode65 through commits rather than through a direct connection, which is the weaker of the two ties the map draws; the text gives no further detail on this persona.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Ram Maharjan” · published 2025-03-27 · pulled 2026-09-18

https://github.com/kanbei0605

github profile IT Worker Fraud MATCHED IN SOURCE live checked 2026-09-18

Listed as kanbei0605

Also listed under Roman Kryveha — this value’s page names all of them.

First seen 2025-03-27 · last seen 2026-10-18

Sources

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18
  • One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's text says this persona reused Karl Chong's about-me paragraph and stock photograph; its network map draws a direct line from the persona to the GitHub account kanbei0605 and a commit-derived line to imcode65. Both accounts are carried here as Nisos's attribution, and a line found on commits is a weaker tie than a direct one.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Roman Kryveha” · published 2025-03-27 · pulled 2026-09-18

  • Nearby text:

    …/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 htt…
    DPRK IT WORKERS UNVEILED – THE RAVEN FILE — The Raven File · under “GITHUB ACCOUNTS OF DPRK IT WORKERS AKA JASPER SLEET” · published 2025-08-28 · pulled 2026-08-30

  • Nearby text:

    …/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 htt…
    DPRK GitHub Accounts — The Raven File · published 2025-08-31 · pulled 2026-09-18

https://github.com/kanbei65

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/kanbei65 is account id 91700749, created on 30 September 2021. 79 of its 100 own commits are signed kanbei0605@gmail.com and the other 21 with a noreply address under the handle kanbei0605, so this account was once named kanbei0605. Nisos names github.com/kanbei0605 under Karl Chong. That handle now belongs to a different account, id 116683582, created on 25 October 2022, which is not this one; which of the two Nisos read cannot be settled from the handle, but the address kanbei0605@gmail.com, which the same reporting gives for the persona, signs this account's commits.
    github.com/kanbei65 — Chollima Hunter · under “Karl Chong” · pulled 2026-09-24

https://github.com/superredstar

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-18

First seen 2025-03-27 · last seen 2025-03-27

Source

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18

https://laborx.com/freelancers/users/id100369

laborx account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as id100369

First seen 2025-03-27 · last seen 2025-03-27

Sources

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18

  • Nearby text:

    …The persona’s profiles on freelancer websites include: https://remoteok.com/@karlchong https://laborx.com/freelancers/users/id100369 https://www.remotehub.com/karl.chong https://www.xing.com/profile/Karl_Chong To obtain the…
    DPRK IT Worker Scam: Mitigation Steps for Hiring Teams — Nisos · under “Freelancer Employment Websites Linked To Karl Chong” · published 2025-03-27 · pulled 2026-09-27

https://remotehub.com/karl.chong

remotehub account IT Worker Fraud MATCHED IN SOURCE

Listed as karl.chong

First seen 2025-03-27 · last seen 2025-03-27

Sources

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18

  • Nearby text:

    …The persona’s profiles on freelancer websites include: https://remoteok.com/@karlchong https://laborx.com/freelancers/users/id100369 https://www.remotehub.com/karl.chong https://www.xing.com/profile/Karl_Chong To obtain the complete research report, including…
    DPRK IT Worker Scam: Mitigation Steps for Hiring Teams — Nisos · under “Freelancer Employment Websites Linked To Karl Chong” · published 2025-03-27 · pulled 2026-09-27

https://remoteok.com/@karlchong

remoteok account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as @karlchong

First seen 2025-03-27 · last seen 2025-03-27

Sources

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18

  • Nearby text:

    …The persona’s profiles on freelancer websites include: https://remoteok.com/@karlchong https://laborx.com/freelancers/users/id100369 https://www.remotehub.com/karl.chong https://www.xing.com/profile/Karl_Chong…
    DPRK IT Worker Scam: Mitigation Steps for Hiring Teams — Nisos · under “Freelancer Employment Websites Linked To Karl Chong” · published 2025-03-27 · pulled 2026-09-27

https://t.me/kanbei0605

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2025-03-27 · last seen 2025-03-27

Source

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18

https://xing.com/profile/karl_chong

xing account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as karl_chong

First seen 2025-03-27 · last seen 2025-03-27

Sources

  • Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
    nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos · under “Karl Chong” · published 2025-03-27 · pulled 2026-09-18

  • Nearby text:

    …include: https://remoteok.com/@karlchong https://laborx.com/freelancers/users/id100369 https://www.remotehub.com/karl.chong https://www.xing.com/profile/Karl_Chong To obtain the complete research report, including endnotes, please click the button below.…
    DPRK IT Worker Scam: Mitigation Steps for Hiring Teams — Nisos · under “Freelancer Employment Websites Linked To Karl Chong” · published 2025-03-27 · pulled 2026-09-27

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Karl Chong as the name of the operator is the cited researcher’s assertion, repeated here as their claim.