Paul Song
Also reported as: grudev325seniordevdrujustine0122snowdev1205BestSilverTiger
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's.
Photograph published by the registry under this persona, captioned there as “Paul Song 1.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Paul Song 2.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Paul Song 3.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Profiles and evidence
Avatar published by the registry under this persona, captioned there as “Paul Song avatar.”. It is the picture the identity presented, not a likeness of anyone.
LinkedIn accounts
paul-song-225505224
removed
linkedin profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as paul-song-225505224
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…(2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ - paul-song-cv.herokuapp.com #### Paul Martin / cryptopunk / gru1125 - Pixelcraft (2022) - cryptopunk - paulmartin.io -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Identifiers reported alongside
10 indicators filed under the same heading, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
BestSilverTiger |
alias | |
Paul Song |
alias | |
seniordev |
alias | |
seniordev1225@gmail.com |
email address | |
snowdev1205@gmail.com |
email address | |
srpaulsong@gmail.com |
email address | |
https://github.com/drujustine0122 |
github profile | live |
https://github.com/grudev325 |
github profile | removed |
https://remoteok.com/@seniordev |
remoteok account | |
https://t.me/grudev325 |
telegram account |
BestSilverTiger
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Paul Song
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
seniordev
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
seniordev1225@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under KGJ — this value’s page names all of them.
Sources
-
The researcher presents all of these accounts as one operator, given only by the initials KGJ, across four posts on the same day. The first lists the X and GitHub accounts, the second names the identities Lendon Bracewell, John Faryno, Flavio Santos and Felix Martel and links a PeoplePerHour freelancer profile, and the last two list the addresses. Both spellings dev0825conscientious and dev0825conscientiouos are transcribed as published; the second looks like a typo the operator made, and correcting it would invent an address. Several of these accounts already reach this site from tayvano's research repository and the lazarus.group registry, so those records carry both citations.
x.com/browsercookies/status/1934035900499104146 — Cookie Connoisseur (@browsercookies) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Paul Song / grudev325 - Pixelcraft (2022), Munchables (2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ - paul-song-cv.herokuapp.com #### Paul…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
snowdev1205@gmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
srpaulsong@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as sr.paul.song@gmail.com
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
… #### Paul Song / grudev325 - Pixelcraft (2022), Munchables (2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/drujustine0122
github profile IT Worker Fraud THIRD-PARTY REGISTRY live
live
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/grudev325
github profile IT Worker Fraud RESEARCHER POST removed
Also listed under KGJ — this value’s page names all of them.
removed
Sources
-
The researcher presents all of these accounts as one operator, given only by the initials KGJ, across four posts on the same day. The first lists the X and GitHub accounts, the second names the identities Lendon Bracewell, John Faryno, Flavio Santos and Felix Martel and links a PeoplePerHour freelancer profile, and the last two list the addresses. Both spellings dev0825conscientious and dev0825conscientiouos are transcribed as published; the second looks like a typo the operator made, and correcting it would invent an address. Several of these accounts already reach this site from tayvano's research repository and the lazarus.group registry, so those records carry both citations.
x.com/browsercookies/status/1934033205709218285 — Cookie Connoisseur (@browsercookies) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://remoteok.com/@seniordev
remoteok account IT Worker Fraud MATCHED IN SOURCE live
Listed as @seniordev
live
Source
-
…Pixelcraft (2022), Munchables (2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ - paul-song-cv.herokuapp.com #### Paul Martin / cryptopunk / gru1125 - Pixelcraft (2022) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://t.me/grudev325
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as grudev325
live
Source
-
…Paul Song / grudev325 - Pixelcraft (2022), Munchables (2024) - grudev325 - sr.paul.song@gmail.com - seniordev1225@gmail.com - t.me/grudev325 - seniordev - remoteok.com/@seniordev - linkedin.com/in/paul-song-225505224/ - paul-song-cv.herokuapp.com #### Paul Martin /…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- x.com/browsercookies/status/1934035900499104146 — Cookie Connoisseur (@browsercookies)
- lazarus.group/team/paul-song — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- x.com/browsercookies/status/1934033205709218285 — Cookie Connoisseur (@browsercookies)