Stenor5

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Stenor5. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2026-04-17

Identifiers attributed to this persona

2 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
stenor0515@gmail.com email address —
https://github.com/stenor5 github profile live checked 2026-09-30

stenor0515@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post eleven presents this account as a probable member rather than a confirmed one: the only other contributor to Dexify-Finance alongside icetrust0212, in the primary account's following list, created January 2022 with the same address-naming pattern. The researcher says in terms that the confirmation is weaker than for the core group, and the record carries that caveat.
    x.com/meow_mfer/status/2045111016187638077 — meow mfer (@meow_mfer) · under “Stenor5” · published 2026-04-17 · pulled 2026-08-30

https://github.com/stenor5

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post eleven presents this account as a probable member rather than a confirmed one: the only other contributor to Dexify-Finance alongside icetrust0212, in the primary account's following list, created January 2022 with the same address-naming pattern. The researcher says in terms that the confirmation is weaker than for the core group, and the record carries that caveat.
    x.com/meow_mfer/status/2045111016187638077 — meow mfer (@meow_mfer) · under “Stenor5” · published 2026-04-17 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Stenor5 as the name of the operator is the cited researcher’s assertion, repeated here as their claim.