Reviewing the activity of GitHub accounts linked to DPRK IT workers
2024-10-18 • North Scan •
Researchers identified a coordinated GitHub network centered on the Finalgoal231 organization and associated it with DPRK IT-worker and social-engineering activity, naming the cluster of accounts the SuperStar Campaign. Members appeared to coordinate stars and contributions, manage multiple identities, rewrite repository metadata, and join legitimate organizations to make fabricated developer profiles more credible. A previously tracked recruiter persona was subsequently linked by Unit 42 to the DPRK-associated CL-STA-0240 Contagious Interview campaign, while the wider network may also support Wagemole employment fraud. Account relationships, recurring profile patterns, exposed email data, and username changes provided the principal evidence connecting the profiles.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| [email protected] | 2024-10-18 | 2024-10-18 | |
| URL | https://github.com/e-nitram | 2024-10-18 | 2024-10-18 |
| URL | https://github.com/Topstar88 | 2024-10-18 | 2024-10-18 |
| URL | https://github.com/ch2888 | 2024-10-18 | 2024-10-18 |
| URL | https://github.com/persec10000 | 2024-10-18 | 2024-10-18 |
| URL | https://github.com/firststar199… | 2024-10-18 | 2024-10-18 |
| URL | https://github.com/Luis96920 | 2024-10-18 | 2024-10-18 |
| URL | https://github.com/Nahuel61920 | 2024-10-18 | 2024-10-18 |
| URL | https://github.com/Finalgoal231 | 2024-10-18 | 2024-10-18 |
| URL | https://github.com/shinevue | 2024-10-18 | 2024-10-18 |
| URL | https://github.com/xaramore | 2024-10-18 | 2024-10-18 |