Son Rim Song

Also reported as: Yuto MatsumoriPinewood

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Son Rim Song. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2025-07-24

Identifiers attributed to this persona

8 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Pinewood alias —
Son Rim Song alias —
Yuto Matsumori alias —
pinewoodaldridge@gmail.com email address —
wrightleo628@gmail.com email address —
yutomatsumoridev2920@gmail.com email address —
https://github.com/pindra2920 github profile live checked 2026-09-30
https://github.com/yuto2920 github profile live checked 2026-09-02

Pinewood

alias IT Worker Fraud RESEARCHER POST

First seen 2025-07-24 · last seen 2025-07-24

Source

  • A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
    x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies) · under “Son Rim Song / Yuto Matsumori / Pinewood” · published 2025-07-24 · pulled 2026-08-30

Son Rim Song

alias IT Worker Fraud RESEARCHER POST

First seen 2025-07-24 · last seen 2025-07-24

Source

  • A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
    x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies) · under “Son Rim Song / Yuto Matsumori / Pinewood” · published 2025-07-24 · pulled 2026-08-30

Yuto Matsumori

alias IT Worker Fraud RESEARCHER POST

First seen 2025-07-24 · last seen 2025-07-24

Source

  • A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
    x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies) · under “Son Rim Song / Yuto Matsumori / Pinewood” · published 2025-07-24 · pulled 2026-08-30

pinewoodaldridge@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-07-24 · last seen 2025-07-24

Source

  • A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
    x.com/browsercookies/status/1948426426145005680 — Cookie Connoisseur (@browsercookies) · under “Son Rim Song / Yuto Matsumori / Pinewood” · published 2025-07-24 · pulled 2026-08-30

wrightleo628@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-07-24 · last seen 2025-07-24

Source

  • A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
    x.com/browsercookies/status/1948426426145005680 — Cookie Connoisseur (@browsercookies) · under “Son Rim Song / Yuto Matsumori / Pinewood” · published 2025-07-24 · pulled 2026-08-30

yutomatsumoridev2920@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-07-24 · last seen 2025-07-24

Source

  • A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
    x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies) · under “Son Rim Song / Yuto Matsumori / Pinewood” · published 2025-07-24 · pulled 2026-08-30

https://github.com/pindra2920

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2025-07-24 · last seen 2025-07-24

Source

  • A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
    x.com/browsercookies/status/1948426426145005680 — Cookie Connoisseur (@browsercookies) · under “Son Rim Song / Yuto Matsumori / Pinewood” · published 2025-07-24 · pulled 2026-08-30

https://github.com/yuto2920

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-07-24 · last seen 2025-07-24

Source

  • A second cell in the 24 July 2025 table image carries this same Korean name over an entirely separate set of accounts -- Pinewood, pinewoodaldridge@gmail.com, github.com/Pindra2920 and wrightleo628@gmail.com -- sharing no value with the Yuto Matsumori cluster above. They are recorded together because the researcher's table files them under one name, and the reader should know that the join between the two clusters is that name and nothing else.
    x.com/browsercookies/status/1948427372744900758 — Cookie Connoisseur (@browsercookies) · under “Son Rim Song / Yuto Matsumori / Pinewood” · published 2025-07-24 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Son Rim Song as the name of the operator is the cited researcher’s assertion, repeated here as their claim.