Ram Maharjan
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Ram Maharjan. The attribution is theirs, not this site's.
Nisos's network map of the four personas, published as Graphic 1 of the cited report, is where this face comes from; it is the image the map shows for this persona, and not necessarily a photograph of the person operating it. The map's lines record which GitHub account, address or Telegram handle Nisos found each persona using directly and which it found only on GitHub commits.
Identifiers attributed to this persona
3 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Ram Maharjan |
alias | |
https://github.com/code-0605 |
github profile | removed |
https://github.com/imcode65 |
github profile | removed |
Ram Maharjan
alias IT Worker Fraud RESEARCHER POST
Source
-
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's network map ties this persona to the GitHub accounts code-0605 and imcode65 through commits rather than through a direct connection, which is the weaker of the two ties the map draws; the text gives no further detail on this persona.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos
https://github.com/code-0605
github profile IT Worker Fraud RESEARCHER POST removed
Also listed under Karl Chong — this value’s page names all of them.
removed
Sources
-
Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's network map ties this persona to the GitHub accounts code-0605 and imcode65 through commits rather than through a direct connection, which is the weaker of the two ties the map draws; the text gives no further detail on this persona.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos
https://github.com/imcode65
github profile IT Worker Fraud RESEARCHER POST removed
Also listed under John Alexander Bird, Roman Kryveha — this value’s page names all of them.
removed
Sources
-
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's text says this persona reused Karl Chong's about-me paragraph and stock photograph; its network map draws a direct line from the persona to the GitHub account kanbei0605 and a commit-derived line to imcode65. Both accounts are carried here as Nisos's attribution, and a line found on commits is a weaker tie than a direct one.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's network map ties this persona to the GitHub accounts code-0605 and imcode65 through commits rather than through a direct connection, which is the weaker of the two ties the map draws; the text gives no further detail on this persona.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
Nisos reports that this persona's resume was created and updated in 2024 through the GitHub account imcode65, that the account is associated with the address kanbei0605@gmail.com also used by Karl Chong, and that the persona had no active personal website when the report was written, which Nisos reads as a persona not yet seeking employment. The network map ties it to imcode65 through commits.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos