Xun Zhu
Also reported as: ican0220RokyangDeveloper0220
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Xun Zhu. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
A webcam still published in the cited post. Unlike a profile picture this is whoever appeared on camera under the identity.
Identifiers attributed to this persona
6 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Xun Zhu |
alias | |
https://hub.docker.com/u/ican0220 |
dockerhub account | live |
devzhu0712@gmail.com |
email address | |
icandev0220@gmail.com |
email address | |
https://github.com/ican0220 |
github profile | removed |
https://gitlab.com/icandev0220 |
gitlab account | live |
Xun Zhu
alias IT Worker Fraud CURATED
Sources
- x.com/Narcass3/status/1955805632189100258 — Narcass3 (@Narcass3)
-
Found on 17 September 2026 by asking Docker Hub whether an account exists under ican0220, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 4 August 2024. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/ican0220 — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- icandev0220 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Ican. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/icandev0220 — Chollima Hunter
https://hub.docker.com/u/ican0220
dockerhub account IT Worker Fraud CURATED live
live
Source
-
Found on 17 September 2026 by asking Docker Hub whether an account exists under ican0220, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 4 August 2024. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/ican0220 — Chollima Hunter
devzhu0712@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
- x.com/Narcass3/status/1955805632189100258 — Narcass3 (@Narcass3)
icandev0220@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
- x.com/Narcass3/status/1955805632189100258 — Narcass3 (@Narcass3)
https://github.com/ican0220
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as ican0220
removed
Sources
- x.com/Narcass3/status/1955805632189100258 — Narcass3 (@Narcass3)
-
…Follow their code on GitHub. https://github.com/ican0220 ○ 각 계정의 특정 리포지터리에서 발견된 위장 취업에 사용된 것으로 추정되는 데이터 를 분석한 결과 도출된 위장 취업 캠페인의 매커니즘은 다음과 같습니다.…
[IG-25-2008-O] Github를 통한 북한 IT 개발자 위장 취업 캠페인 : North Korean IT Developer Fake Employment Campaign via Github — IGLOO Security
https://gitlab.com/icandev0220
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- icandev0220 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Ican. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/icandev0220 — Chollima Hunter
Sources
- [IG-25-2008-O] Github를 통한 북한 IT 개발자 위장 취업 캠페인 : North Korean IT Developer Fake Employment Campaign via Github — Igloo Corporation (Korean)
- x.com/Narcass3/status/1955805632189100258 — Narcass3 (@Narcass3)
- hub.docker.com/u/ican0220 — Chollima Hunter
- gitlab.com/icandev0220 — Chollima Hunter