Roman Kryveha
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Roman Kryveha. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Nisos's network map of the four personas, published as Graphic 1 of the cited report, is where this face comes from; it is the image the map shows for this persona, and not necessarily a photograph of the person operating it. The map's lines record which GitHub account, address or Telegram handle Nisos found each persona using directly and which it found only on GitHub commits.
Identifiers attributed to this persona
5 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Roman Kryveha |
alias | |
https://discord.com/users/1042840615358054460 |
discord account | |
johnalexanderbird@gmail.com |
email address | |
https://github.com/imcode65 |
github profile | removed |
https://github.com/kanbei0605 |
github profile | live |
Roman Kryveha
alias IT Worker Fraud CURATED
Sources
-
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's text says this persona reused Karl Chong's about-me paragraph and stock photograph; its network map draws a direct line from the persona to the GitHub account kanbei0605 and a commit-derived line to imcode65. Both accounts are carried here as Nisos's attribution, and a line found on commits is a weaker tie than a direct one.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (imcode65) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
github.com/kanbei65/jab-p/blob/c5b028516e1adcd20a3d7219c082368c6b680723/index.html — Chollima Hunter
https://discord.com/users/1042840615358054460
discord account IT Worker Fraud CURATED
Source
-
Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (imcode65) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
github.com/kanbei65/jab-p/blob/c5b028516e1adcd20a3d7219c082368c6b680723/index.html — Chollima Hunter
johnalexanderbird@gmail.com
email address IT Worker Fraud CURATED
Source
-
Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (imcode65) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
github.com/kanbei65/jab-p/blob/c5b028516e1adcd20a3d7219c082368c6b680723/index.html — Chollima Hunter
https://github.com/imcode65
github profile IT Worker Fraud RESEARCHER POST removed
Also listed under John Alexander Bird, Ram Maharjan — this value’s page names all of them.
removed
Sources
-
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's text says this persona reused Karl Chong's about-me paragraph and stock photograph; its network map draws a direct line from the persona to the GitHub account kanbei0605 and a commit-derived line to imcode65. Both accounts are carried here as Nisos's attribution, and a line found on commits is a weaker tie than a direct one.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's network map ties this persona to the GitHub accounts code-0605 and imcode65 through commits rather than through a direct connection, which is the weaker of the two ties the map draws; the text gives no further detail on this persona.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
Nisos reports that this persona's resume was created and updated in 2024 through the GitHub account imcode65, that the account is associated with the address kanbei0605@gmail.com also used by Karl Chong, and that the persona had no active personal website when the report was written, which Nisos reads as a persona not yet seeking employment. The network map ties it to imcode65 through commits.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos
https://github.com/kanbei0605
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as kanbei0605
Also listed under Karl Chong — this value’s page names all of them.
live
Sources
-
Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
One of three personas Nisos reports were created in 2024 alongside Karl Chong and share its contact information. The report's text says this persona reused Karl Chong's about-me paragraph and stock photograph; its network map draws a direct line from the persona to the GitHub account kanbei0605 and a commit-derived line to imcode65. Both accounts are carried here as Nisos's attribution, and a line found on commits is a weaker tie than a direct one.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
…/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 htt…
DPRK IT WORKERS UNVEILED – THE RAVEN FILE — The Raven File -
…/fongjengchang https://github.com/PainStaker0331 https://github.com/DevGambles https://github.com/james888 https://github.com/jayevans-star https://github.com/kanbei0605 https://github.com/KeepGrowingHere https://gist.github.com/kevin921115 https://github.com/naruhitokaide https://github.com/lprfacial247 htt…
DPRK GitHub Accounts — The Raven File
Sources
- DPRK IT WORKERS UNVEILED – THE RAVEN FILE — The Raven File
- DPRK GitHub Accounts — The Raven File
- nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos
- github.com/kanbei65/jab-p/blob/c5b028516e1adcd20a3d7219c082368c6b680723/index.html — Chollima Hunter