Ketman
Also reported as: OnlyDust freelance identities
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below was filed under the heading “OnlyDust freelance identities (Ketman)” by the report that documented it.
LinkedIn accounts
https://www.linkedin.com/in/maksym-poplavskyi-337b782bb/
removed
linkedin profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as maksym-poplavskyi-337b782bb
Sources
-
The report on DPRK IT workers on the OnlyDust platform opens with the GitHub account 0xExp-po, finds in bestselection18's Automation-bot repository clues to how many fake identities the actor runs, and ties the V0410 identity to a Fiverr gig and a LinkedIn profile under the name Maksym Poplavskyi, deleted by the time of writing.
www.ketman.org/dprk-it-workers-in-freelance-platform-onlyDust.html — bbsz (@blackbigswan) -
…platforms: https://www.fiverr.com/vincenzagiorgi6/make-meme-coin-tax-token-presale-staking-pumpfun-on-ethereum-base-solana-ton https://ua.linkedin.com/in/maksym-poplavskyi-337b782bb [deleted 2 months ago] vincenzagiorgi6@gmail.com : V0410 There are more significant connections between few other distant…
DPRK IT Workers in Open Source and Freelance Platforms - Ketman - Threat intelligence for remote and open source organizations — ketman.org
Identifiers reported alongside
3 indicators filed under the same heading, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
https://fiverr.com/vincenzagiorgi6 |
fiverr account | |
https://github.com/0xexp-po |
github profile | removed |
bestselection18/Automation-bot |
malicious repository |
https://fiverr.com/vincenzagiorgi6
fiverr account IT Worker Fraud MATCHED IN SOURCE
Listed as vincenzagiorgi6
Sources
-
The report on DPRK IT workers on the OnlyDust platform opens with the GitHub account 0xExp-po, finds in bestselection18's Automation-bot repository clues to how many fake identities the actor runs, and ties the V0410 identity to a Fiverr gig and a LinkedIn profile under the name Maksym Poplavskyi, deleted by the time of writing.
www.ketman.org/dprk-it-workers-in-freelance-platform-onlyDust.html — bbsz (@blackbigswan) -
…of this name (a Ukrainian name, a choice we observe being popular with DPRK actors) is active on the Fiverr and LinkedIn platforms: https://www.fiverr.com/vincenzagiorgi6/make-meme-coin-tax-token-presale-staking-pumpfun-on-ethereum-base-solana-ton https://ua.linkedin.com/in/maksym-poplavskyi-337b782bb…
DPRK IT Workers in Open Source and Freelance Platforms - Ketman - Threat intelligence for remote and open source organizations — ketman.org
https://github.com/0xexp-po
github profile IT Worker Fraud RESEARCHER POST removed
removed
Source
-
The report on DPRK IT workers on the OnlyDust platform opens with the GitHub account 0xExp-po, finds in bestselection18's Automation-bot repository clues to how many fake identities the actor runs, and ties the V0410 identity to a Fiverr gig and a LinkedIn profile under the name Maksym Poplavskyi, deleted by the time of writing.
www.ketman.org/dprk-it-workers-in-freelance-platform-onlyDust.html — bbsz (@blackbigswan)
bestselection18/Automation-bot
malicious repository IT Worker Fraud RESEARCHER POST Taken down
Source
-
The report on DPRK IT workers on the OnlyDust platform opens with the GitHub account 0xExp-po, finds in bestselection18's Automation-bot repository clues to how many fake identities the actor runs, and ties the V0410 identity to a Fiverr gig and a LinkedIn profile under the name Maksym Poplavskyi, deleted by the time of writing.
www.ketman.org/dprk-it-workers-in-freelance-platform-onlyDust.html — bbsz (@blackbigswan)