Poseidon
Also reported as: James LarrySteven Bakarich
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Poseidon. The attribution is theirs, not this site's.
Profiles and evidence
ZachXBT table of the team’s fabricated identities, listing the GitHub, LinkedIn and email each member used.
Directory listing the researcher attributes to the team: Payoneer receipts, wallet seed phrases, GitHub recovery codes and identity-document scans (faces redacted in the source).
Identifiers attributed to this persona
5 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
James Larry |
alias | |
Poseidon |
alias | |
Steven Bakarich |
alias | |
larryjamhenryiv@gmail.com |
email address | |
stevenbakarich607@gmail.com |
email address |
James Larry
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Poseidon
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Steven Bakarich
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
larryjamhenryiv@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as larryjam.henry.iv@gmail.com
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…lahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding this, you can read the following articles to get a 360 view on the incident.…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
stevenbakarich607@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…eam1218917@gmail.com hasibullahnasseri986@gmail.com CharlieWang1218917.dream@proton.me andriisokyrka@gmail.com dreamit.dev1218917@gmail.com stevenbakarich607@gmail.com larryjam.henry.iv@gmail.com FURTHER READING Regarding this, you can read the following articles to get a 360 view on the incident.…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)