Narcass3 (@Narcass3) header
Narcass3 (@Narcass3) profile picture

Narcass3

@Narcass3

Huntin DPRK for funz. Shout misfits I will eat you

Joined April 2025
  • Tweets102
  • Following45
  • Followers700
43Media
Photo by Narcass3 (@Narcass3)Photo by Narcass3 (@Narcass3)Photo by Narcass3 (@Narcass3)Photo by Narcass3 (@Narcass3)Photo by Narcass3 (@Narcass3)Photo by Narcass3 (@Narcass3)Photo by Narcass3 (@Narcass3)Photo by Narcass3 (@Narcass3)Photo by Narcass3 (@Narcass3)Photo by Narcass3 (@Narcass3)
"Nothing to luck, Everything to effort. Believe yourself and get success."
Image from Narcass3 (@Narcass3)
1
1
14
3,211
Narcass3 retweeted
aptwhatnow (@aptwhatnow) profile picture
aptwhatnow@aptwhatnow12h
We see DPRK's denial of the Binance hack and we raise you one response TO the response. Thank you for your attention to this matter. DPRK response kcna.kp/en/article/detail/87… Ours: @Narcass3 @SttyK @tayvano_ @blackbigswan @superducktoes @browsercookies @bax1337 @tanuki42_ etc...
Image from aptwhatnow (@aptwhatnow)
4
10
7
64
13,660
🙂
Encrypted Films (@Encrypted_Films) profile pictureEncrypted Films
@Encrypted_FilmsOct 30
The scale of the danger North Korea poses to crypto has become impossible to ignore. This is the story of the investigators exposing North Korean operatives working inside the industry. You think you know who your developer is. But do you? 🎬 Introducing THE DEVELOPER.
2
159
Narcass3 retweeted
Narcass3 (@Narcass3) profile picture
Narcass3@Narcass3Aug 31
Here is Kim Sang Man and Kim Hyo Dong, heads of North Korean Chinyong IT Worker Delegation. Sang Man was seen with IT Workers in Vladivostok in 2024 with Hyo Dong, who was also in Laos in 2023 with Naoki Murano and other IT workers.
Image from Narcass3 (@Narcass3)
Image from Narcass3 (@Narcass3)
Image from Narcass3 (@Narcass3)
1
11
32
4,323
Here is Kim Sang Man and Kim Hyo Dong, heads of North Korean Chinyong IT Worker Delegation. Sang Man was seen with IT Workers in Vladivostok in 2024 with Hyo Dong, who was also in Laos in 2023 with Naoki Murano and other IT workers.
Image from Narcass3 (@Narcass3)
Image from Narcass3 (@Narcass3)
Image from Narcass3 (@Narcass3)
1
11
32
4,323
Narcass3 retweeted
Sam Kessler (@skesslr) profile picture
Sam Kessler@skesslrAug 13
For all that and more: our documentary is out today. I'm so incredibly proud to work with reporters like @emmatscott and @bobmcmillan—and the many other incredible colleagues who helped us put this together over the past year. Thanks also to the many experts who helped with our reporting behind the scenes: @tayvano_ @zachxbt @NickCarlsen1 @tanuki42_ (and others... thank you!) wsj.com/business/media/insid… 9/
Inside North Korea’s Operation to Conquer the American Job Market

Inside North Korea’s Operation to Conquer the American Job Market

Watch how Pyongyang’s scheme to generate $800 million a year works.

wsj.com
1
26
7
87
22,609
Do you know whats interesting about this paper? I'll give you a hint: one of the authors is a North Korean IT Worker. 🧵
Image from Narcass3 (@Narcass3)
3
3
13
1,815
Meet He-Song Cui, also known as Ash Palani, Uri Choi, and Zagreb Choi. He has claimed to be a Malaysian fullstack developer living in Kuala Lampur, as well as a in Khabarovsk and Moscow. I'm not sure he bothered getting into an academic journal, but props to him.
Image from Narcass3 (@Narcass3)
1
3
353
[email protected] [email protected] [email protected] github.com/jsreputation keybase.io/ashpala dev.to/ashpala
jsreputation - Overview

jsreputation - Overview

All good things to those who wait. jsreputation has 33 repositories available. Follow their code on GitHub.

github.com
2
151
"Brian Tonui" was a very interesting IT Worker. He worked at an exchange building their KYC/AML, worked at Funnull with admin access and used the GH account associated with the Polyfill supply-chain attack. He also used services of Serbian industrial laptop farmers. 1/
Image from Narcass3 (@Narcass3)
2
8
3
37
9,213
more replies
Persona cost ranged from $70-$300, non VOIP mobile numbers used Pushbullet and AirDroid to allow ITWs to receive texts, came with Payoneer, Paypal, Upwork, Freelancer accounts and real identity. Some passwords hinted and there being 150+ laptops in use. 2/
Image from Narcass3 (@Narcass3)
1
2
926
The DRC Team administrator used these email and skype accounts for support: live:.cid.f71c2eecb5ef334e live:miloskoj07 [email protected] Persona/Payment info: [email protected] [email protected] [email protected] [email protected] [email protected]
3
622
Image from Narcass3 (@Narcass3)
1
5
1,221
Narcass3 retweeted
ZachXBT (@zachxbt) profile picture
ZachXBT
@zachxbtApr 7
Replying to @CR1337 @moothefarmer
TLDR: DPRK ITWs got caught via OSINT after partying in Laos on New Years a few years back by Chollima Group Source: chollima-group.io/posts/trac…
Image from ZachXBT (@zachxbt)
13
66
11
602
362,477
Narcass3 retweeted
ZachXBT (@zachxbt) profile picture
ZachXBT
@zachxbtApr 7
Replying to @moothefarmer
Stop virtue signaling you conveniently left out the fact that you had a DPRK IT worker on payroll at Elemental for years. Name: Keisuke Watanabe X: kasky53 GitHub alias: keisukew53, kdevdivvy, kasky53, 0xWoo Email: keisukew53@gmail[.]com Related addresses: JBxidGWnhtPTGg8xw7sFT9tF4cfGtHnjYNp5GDJvGveh 8mdfRML7z3s8gqDYd72bywcEgQtcvkoJCw2bukv8X71R BjGhtq5Vh9Lv1xxBJ6pZKx3ZCmsEHPVoWNZZGdHkVQ4p DybGDChJMvX9Jnza4XTQVDyUGZ6jYrRg9Q3CdLiEJeh2 0x1b89aecc0f8c128150db67d7d0c4b1daeb43eda4 0x3b6cdb27d54c5773893be72973eacc8681fa21ff 0x161dea4d7ac627f2bc4358dfece386c0e9f4cc8f
Image from ZachXBT (@zachxbt)
Image from ZachXBT (@zachxbt)
Image from ZachXBT (@zachxbt)
Image from ZachXBT (@zachxbt)
57
59
41
1,087
186,075
Contrary to the quoted tweet, @sexinfochina is in fact the admin of the Chinese darknet market FreeCity. Behind the handle is Xiao He, a Chinese national who is a prolific launderer of DPRK stolen funds, supporter of DPRK IT Worker ops, and pusher of fake viagra.
Image from Narcass3 (@Narcass3)
Image from Narcass3 (@Narcass3)
Image from Narcass3 (@Narcass3)
AI骆驼 (@sexinfochina) profile pictureAI骆驼
@sexinfochinaFeb 14
Replying to @zachxbt @THORSwap @avax @SwapKitPowered @NEARProtocol @near_intents @AlexAuroraDev
I am NOT the operator of ‘FreeCity’ or ANY darknet market. That tg account doesn't belong to me. I’m a trader whose 10 BTC is frozen by @near_intents under shady “compliance review.” You’re smearing me to deflect from THEIR theft. This is libel, not journalism. false accusations damaging reputation = criminal offense. Retract or lawyer up. Crypto community: Demand proof before believing smears. You're the real bad guy who started this whole thing. You're helping out the big shots behind the scenes, pretending to uphold blockchain justice all along. So your money also comes from the crypto community? Can you guarantee that all your upstream funds are completely legal?
5
11
6
70
16,865
more replies
IOCs [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] komonado
1
13
816
camonanesi zhangguib chaindeler peterz-codes deamchain sexdrugchina sexchinainfo +971561361688 +447756923041 +12135699745 +85255790957 +8617338660205 +8613717701687 Powel Lee wilfwolf085 Peter Zhou He Shawn Trashare He
11
735
Load more