spring day

Also reported as: RJM

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, spring day. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2026-08-13

Identifiers attributed to this persona

2 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
RJM alias —
spring day alias —

RJM

alias IT Worker Fraud RESEARCHER POST

First seen 2026-08-13 · last seen 2026-08-13

Source

  • The operator whose archive is the basis of Hayden McKenzie's second report goes by "spring day" and the initials RJM, manages a team of three, and is associated with teams named Color Team and Team Dev Money.
    haydenmckenzie.com/research/dprk-it-worker-operation-part-two — Hayden McKenzie · under “spring day / RJM” · published 2026-08-13 · pulled 2026-09-24

spring day

alias IT Worker Fraud RESEARCHER POST

First seen 2026-08-13 · last seen 2026-08-13

Source

  • The operator whose archive is the basis of Hayden McKenzie's second report goes by "spring day" and the initials RJM, manages a team of three, and is associated with teams named Color Team and Team Dev Money.
    haydenmckenzie.com/research/dprk-it-worker-operation-part-two — Hayden McKenzie · under “spring day / RJM” · published 2026-08-13 · pulled 2026-09-24

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. spring day as the name of the operator is the cited researcher’s assertion, repeated here as their claim.