source_3909.pdf (2 MB)

NorthScan links Beejern, an active Oklahoma LLC, to a suspected DPRK IT worker network through GitHub identity cycling, DPRK-associated developer personas, exposed Beejern credentials, and reused company infrastructure. The GoldenDev321 account previously used the Redsky500 and Dragonlee321 names, while related repository data exposed the dragonlideveloper identity and Beejern email addresses. Beejern, SprintiQ, DreamHi, QN Software, and Prytania Consulting shared developers, telephone numbers, or addresses, including a cluster in Danang, Vietnam. Fabricated staff photographs and coordinated listings on UpWork and business directories were used to give the companies a credible public presence.