🇰🇵 For a few months, I posed as a recruiter and engaged a DPRK persona known as Jason Kwon, who appeared to be operating as hightechrun shortly after news of m00n was shared. He later introduced himself as Roy Hensley. At the present, there is a possibility his current alias is on a shared upwork profile. Without knowing when that profile was put into play, it’s unconfirmed if that alias has entered any projects or been exposed. Some of this will be familiar to researchers who follow DPRK activity as this wasn’t attribution built from scratch. It started with existing research from @zachxbt being publicly shared and some tracking by @intell_on_chain (@rugpullfinder). During our conversations and conveniently in the Beanstalk discord, he shared the 0xm00n GitHub account and later explained it as an “agency” account. I used decoy documents, and CanaryTokens to collect what was possible about working environments. The summary covers the identity changes I could follow and connections collected during the small engagement. I’m publishing this now because I want to get back into documenting, not leaving helpful info sitting in DMs, screenshots, and drafts. Additional context can help someone else connect an account, recognize a recycled persona, or pick up a thread you couldn’t follow further. Link to medium article ⬇️ and thanks to all involved in this. @0xfigo has recently shared some work done behind the scenes with @north_scan involving tracking DPRK so I’m mentioning that as a resource available for those doing work on our beloved IT Workers. medium.com/@0xsaiyangod/meet…