Son Rim Song
Also reported as: Yuto MatsumoriPinewood
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Son Rim Song. The attribution is theirs, not this site's.
Identifiers attributed to this persona
8 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Pinewood |
alias | |
Son Rim Song |
alias | |
Yuto Matsumori |
alias | |
pinewoodaldridge@gmail.com |
email address | |
wrightleo628@gmail.com |
email address | |
yutomatsumoridev2920@gmail.com |
email address | |
https://github.com/pindra2920 |
github profile | live |
https://github.com/yuto2920 |
github profile | live |
Pinewood
alias IT Worker Fraud RESEARCHER POST
Source
-
A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies)
Son Rim Song
alias IT Worker Fraud RESEARCHER POST
Source
-
A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies)
Yuto Matsumori
alias IT Worker Fraud RESEARCHER POST
Source
-
A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies)
pinewoodaldridge@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
x.com/browsercookies/status/1948426426145005680 — Cookie Connoisseur (@browsercookies)
wrightleo628@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
x.com/browsercookies/status/1948426426145005680 — Cookie Connoisseur (@browsercookies)
yutomatsumoridev2920@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies)
https://github.com/pindra2920
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
x.com/browsercookies/status/1948426426145005680 — Cookie Connoisseur (@browsercookies)
https://github.com/yuto2920
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies)
Sources
- x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1948426426145005680 — Cookie Connoisseur (@browsercookies)