Chollima Hunter

← All personas

m4rcu5o

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, m4rcu5o. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-08-26 · last reported 2025-10-01

Identifiers attributed to this persona

9 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
https://calendly.com/nailrusty-dev calendly account not checked
https://github.com/m4rcu5o github profile removed checked 2026-09-30
https://t.me/idiorusty telegram account live checked 2026-11-08
https://t.me/itsmyturn93 telegram account live checked 2026-11-08
https://t.me/m4rcu5o telegram account live checked 2026-11-08
https://t.me/pup5ol telegram account live checked 2026-11-08
https://t.me/stevensprg telegram account live checked 2026-11-08
https://x.com/hudes0112 x account not checked
https://x.com/m4rcu5o x account not checked

https://calendly.com/nailrusty-dev

calendly account IT Worker Fraud MATCHED IN SOURCE

Listed as nailrusty-dev

First seen 2025-10-01 · last seen 2025-10-01

Sources

https://github.com/m4rcu5o

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-09-30

Listed as m4rcu5o

First seen 2025-08-26 · last seen 2026-11-13

Sources

https://t.me/idiorusty

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as idiorusty

First seen 2025-08-26 · last seen 2026-11-13

Sources

https://t.me/itsmyturn93

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2025-10-01 · last seen 2025-10-01

Source

  • The report gives m4rcu5o an active X account and an older Telegram handle, and notes that m4rcu5o's Calendly page uses the same name as AnotherRusty's.
    www.ketman.org/dprk-it-workers-github-organizations.html — bbsz (@blackbigswan) · under “m4rcu5o” · published 2025-10-01 · pulled 2026-09-29

https://t.me/m4rcu5o

telegram account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by putting m4rcu5o, the GitHub login this persona is named for, to Maigret's username search and reading the Telegram page it reported, cited here. The page states the display name M4rcu5, a restatement of the handle, and no bio. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    t.me/m4rcu5o — Chollima Hunter · under “m4rcu5o” · pulled 2026-09-18

https://t.me/pup5ol

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as pup5ol

First seen 2025-08-26 · last seen 2026-11-13

Sources

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. The chart gives idioRusty as the current Telegram handle and pup5ol and stevensprg as former ones, and a Pinterest account under hudes0112 for which this site has no extractor. The same GitHub account and the hudes0112 address already reach this site from ketman.org's HyperbuildX reporting, which files it under the name AnotherRusty.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “m4rcu5o” · published 2025-08-26 · pulled 2026-08-30
  • …{"id":"15d11713e92779ce","type":"link","url":"https://t.me/pup5ol","x":4620,"y":-2040,"width":400,"height":400,"color":"4"},…
    HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

https://t.me/stevensprg

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as stevensprg

First seen 2025-08-26 · last seen 2026-11-13

Sources

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. The chart gives idioRusty as the current Telegram handle and pup5ol and stevensprg as former ones, and a Pinterest account under hudes0112 for which this site has no extractor. The same GitHub account and the hudes0112 address already reach this site from ketman.org's HyperbuildX reporting, which files it under the name AnotherRusty.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “m4rcu5o” · published 2025-08-26 · pulled 2026-08-30
  • …{"id":"fb66ac792f838807","type":"link","url":"https://t.me/stevensprg","x":4620,"y":-420,"width":400,"height":400},…
    HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

https://x.com/hudes0112

x account IT Worker Fraud RESEARCHER POST

First seen 2025-08-26 · last seen 2025-08-26

Source

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. The chart gives idioRusty as the current Telegram handle and pup5ol and stevensprg as former ones, and a Pinterest account under hudes0112 for which this site has no extractor. The same GitHub account and the hudes0112 address already reach this site from ketman.org's HyperbuildX reporting, which files it under the name AnotherRusty.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “m4rcu5o” · published 2025-08-26 · pulled 2026-08-30

https://x.com/m4rcu5o

x account IT Worker Fraud RESEARCHER POST

First seen 2025-10-01 · last seen 2025-10-01

Source

  • The report gives m4rcu5o an active X account and an older Telegram handle, and notes that m4rcu5o's Calendly page uses the same name as AnotherRusty's.
    www.ketman.org/dprk-it-workers-github-organizations.html — bbsz (@blackbigswan) · under “m4rcu5o” · published 2025-10-01 · pulled 2026-09-29

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. m4rcu5o as the name of the operator is the cited researcher’s assertion, repeated here as their claim.