Renz Patdu

Confirmed by Chollima Hunter research and rated medium confidence; corroborated by Table 1: Russian IP ranges used in suspected North Korea-related campaigns, including 80.237.87.0/24, Trend Micro; TTK addresses associated with North Korean IT workers, including 80.237.87.21, ReliaQuest. From Chollima Hunter research, read on 3 October 2026. The applicant presenting as Renz Patdu, at renzpatdu0601@gmail.com, was recorded active from 80.237.87.36. That address is in 80.237.87.0/24, registered in RIPE as SKYFREIGHT-NET under TransTeleCom (AS20485) with the description "SKYFREIGHT, Hasan, Russia" and a Khabarovsk contact. Trend Micro lists that exact range, created in December 2024 and located at Khasan on the Russia-North Korea border, among the Russian ranges used in suspected North Korea-related campaigns, and ReliaQuest lists 80.237.87.21, in the same /24, among the TransTeleCom addresses used by North Korean IT workers. LinkedIn's people search returns two accounts under the name. renz-patdu-9992423b0 joined LinkedIn in February 2026 and presents a Senior Software Engineer at Atlassian in San Fernando, the Philippines, educated at Fudan University in Shanghai, with 54 connections and no verifications. renz-patdu-6a12373ba joined in March 2026 and presents a Senior Data Scientist at Antiland in Pasig, with no connections or posts. Which account the applicant used is not recorded.

Confirmed by Chollima Hunter research and rated medium confidence; corroborated by Table 1: Russian IP ranges used in suspected North Korea-related campaigns, including 80.237.87.0/24, Trend Micro; TTK addresses associated with North Korean IT workers, including 80.237.87.21, ReliaQuest. From Chollima Hunter research, read on 3 October 2026. The applicant presenting as Renz Patdu, at renzpatdu0601@gmail.com, was recorded active from 80.237.87.36. That address is in 80.237.87.0/24, registered in RIPE as SKYFREIGHT-NET under TransTeleCom (AS20485) with the description "SKYFREIGHT, Hasan, Russia" and a Khabarovsk contact. Trend Micro lists that exact range, created in December 2024 and located at Khasan on the Russia-North Korea border, among the Russian ranges used in suspected North Korea-related campaigns, and ReliaQuest lists 80.237.87.21, in the same /24, among the TransTeleCom addresses used by North Korean IT workers. LinkedIn's people search returns two accounts under the name. renz-patdu-9992423b0 joined LinkedIn in February 2026 and presents a Senior Software Engineer at Atlassian in San Fernando, the Philippines, educated at Fudan University in Shanghai, with 54 connections and no verifications. renz-patdu-6a12373ba joined in March 2026 and presents a Senior Data Scientist at Antiland in Pasig, with no connections or posts. Which account the applicant used is not recorded.