Pak Guk Song
Also reported as: Marvelous Tech
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Pak Guk Song. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Identifiers attributed to this persona
5 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Marvelous Tech |
alias | |
Pak Guk Song |
alias | |
https://dev.to/rusuland9 |
devto account | live |
rusuland9@gmail.com |
email address | |
https://github.com/rusuland9 |
github profile | removed |
Marvelous Tech
alias IT Worker Fraud RESEARCHER POST
Source
- x.com/browsercookies/status/1948427231589515463 — Cookie Connoisseur (@browsercookies)
Pak Guk Song
alias IT Worker Fraud CURATED
Sources
- x.com/browsercookies/status/1948427231589515463 — Cookie Connoisseur (@browsercookies)
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- rusuland9 -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 8 July 2025 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/rusuland9 — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 2 commits signed rusuland9@gmail.com, an address browsercookies publishes for this persona, to the login rusuland9, which no longer resolves.
github.com/rusuland9 — Chollima Hunter
https://dev.to/rusuland9
devto account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- rusuland9 -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 8 July 2025 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/rusuland9 — Chollima Hunter
rusuland9@gmail.com
email address IT Worker Fraud CURATED
Sources
- x.com/browsercookies/status/1948427231589515463 — Cookie Connoisseur (@browsercookies)
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 2 commits signed rusuland9@gmail.com, an address browsercookies publishes for this persona, to the login rusuland9, which no longer resolves.
github.com/rusuland9 — Chollima Hunter
https://github.com/rusuland9
github profile IT Worker Fraud CURATED removed
removed
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 2 commits signed rusuland9@gmail.com, an address browsercookies publishes for this persona, to the login rusuland9, which no longer resolves.
github.com/rusuland9 — Chollima Hunter
Sources
- x.com/browsercookies/status/1948427231589515463 — Cookie Connoisseur (@browsercookies)
- dev.to/rusuland9 — Chollima Hunter
- github.com/rusuland9 — Chollima Hunter