Hopefully yall enjoy small charts of NorthKorean IT worker accounts
Contents
Hopefully yall enjoy small charts of #NorthKorean IT worker accounts.
Today, it's a post-minions assessment.
Cryptogru, formerly aidenwong812 and alternatively Donald-romeo-1100, was observed making the initial commits to codez17.
codez17 pushed a commit on Mar 7 replacing references of cryptogru812 to madara1793, another alternate bearing the same pfp as codezs17.
The alias "Brody Swift" is also present on madara1793, but was replaced for codezeus17 following the #DPRK obsession with Greek mythology.
Two accounts solely following and stargazing codezs17 also popped up recently bearing the "Brody" moniker.
Additionally, two accounts bearing a "Mars" moniker also appeared solely following and stargazing codezs17 with Kali1793 matching the user's former "1793" naming scheme.
- BrodySwift has an altered image of their face titled "me.jpg" (attached) https://github.com/BrodySwift/dd
- Kali1793 is a coauthor on codezs17's repo.
- codezs17 responds to discussions in an attempt to add legitimacy to these accounts
Finally, some (but certainly not all) the IOCs I had …
Today, it's a post-minions assessment.
Cryptogru, formerly aidenwong812 and alternatively Donald-romeo-1100, was observed making the initial commits to codez17.
codez17 pushed a commit on Mar 7 replacing references of cryptogru812 to madara1793, another alternate bearing the same pfp as codezs17.
The alias "Brody Swift" is also present on madara1793, but was replaced for codezeus17 following the #DPRK obsession with Greek mythology.
Two accounts solely following and stargazing codezs17 also popped up recently bearing the "Brody" moniker.
Additionally, two accounts bearing a "Mars" moniker also appeared solely following and stargazing codezs17 with Kali1793 matching the user's former "1793" naming scheme.
- BrodySwift has an altered image of their face titled "me.jpg" (attached) https://github.com/BrodySwift/dd
- Kali1793 is a coauthor on codezs17's repo.
- codezs17 responds to discussions in an attempt to add legitimacy to these accounts
Finally, some (but certainly not all) the IOCs I had …