NorthScan identified `fullstackdev0110`, `reo0603`, and `buddy0323` as a coordinated GitHub persona cluster displaying indicators consistent with DPRK IT worker activity. The strongest evidence involved `reo0603`, which repurposed an Indian developer’s portfolio, used another person’s photograph, and presented contradictory identity and location data. Repeated, ordered commit references by dozens of accounts across unrelated historical GitHub issues suggest a scripted or shared workflow for manufacturing contribution history and credibility. Overlap with the `ghost`, `NeymaFullStack`, and `7codewizard` proxy-interview recruitment infrastructure further connects the cluster to previously reported DPRK IT worker methods.