"Taro" is part of a cell I've been calling "215"
Contents
Great work by @tanuki42 exposing "Taro Aikuchi" as a DPRK IT worker. I've run the IOCs through my DPRK threat intelligence database (33,600+ confirmed accounts) and the results go much deeper than a single fake identity. "Taro" is part of a cell I've been calling "215". Sharing that data here in this thread.
tanuki42
tanuki42
@tanuki42_
Apr 14
View on Twitter
1/12 Lots of people asking if I make every Asian male I interview insult Kim Jong Un - for the avoidance of doubt, I only ask someone to insult Marshal Kim when I'm already confident they're North Korean and trying to defraud.
But how did I know Taro was North Korean? 🧵
🧵 2/10
The number 215 isn't random. It appears in EVERY identity linked to this operator:
- 0xbomb215 (GitHub)
- [email protected] (application email)
- [email protected] (CV email)
- [email protected] (git commit email)
- xsen215 (git co-author alias)
One person. Five accounts. Same numeric fingerprint.
🧵 3/10
I've searched "215" across my database of …
tanuki42
tanuki42
@tanuki42_
Apr 14
View on Twitter
1/12 Lots of people asking if I make every Asian male I interview insult Kim Jong Un - for the avoidance of doubt, I only ask someone to insult Marshal Kim when I'm already confident they're North Korean and trying to defraud.
But how did I know Taro was North Korean? 🧵
🧵 2/10
The number 215 isn't random. It appears in EVERY identity linked to this operator:
- 0xbomb215 (GitHub)
- [email protected] (application email)
- [email protected] (CV email)
- [email protected] (git commit email)
- xsen215 (git co-author alias)
One person. Five accounts. Same numeric fingerprint.
🧵 3/10
I've searched "215" across my database of …