← Remote Workers

DreamHigh

DreamHigh is an alias that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cookie Connoisseur (@browsercookies) and Lazarus Group DPRK IT-Worker Registry (lazarus.group). The reports are dated 2025-05-17.

alias IT Worker Fraud RESEARCHER POST

Listed under Damian Mularz, William Loy.

First seen 2025-05-17 · last seen 2025-05-17

Sources

• The same foxcorp organisation prompt appears on the GitHub profile in the Axiom 88 entry, captured by the same researcher two days earlier.

  x.com/browsercookies/status/1923549354025234903 — Cookie Connoisseur (@browsercookies) · under “William Loy / Jiro Yamamoto / Jiro Ya / DreamHigh / DreamHigh0806 / Oleksandr Oleinik” · published 2025-05-17 · pulled 2026-08-30

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Damian Mularz / Tony Guo / Sergio Ramos / DreamHigh / Netdragon986 / 0xwhiz” · pulled 2026-09-09

Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.

Related indicators

Same persona record: Damian Mularz

Other identifiers the reporting files under the same persona; 4 of 13 are shown.

• damianmularz725@gmail.com email address
• https://github.com/evgpan GitHub account
• https://gitlab.com/evgpan GitLab account
• +48667729989 telephone number

All 13 on the Damian Mularz page

Same persona record: William Loy

Other identifiers the reporting files under the same persona; 4 of 6 are shown.

• Jiro Yamamoto alias
• Oleksandr Oleinik alias
• ssguardheaker@gmail.com email address
• https://github.com/dreamhigh0806 GitHub account

All 6 on the William Loy page

Cited by the same report: x.com/browsercookies/status/1923549354025234903

Cookie Connoisseur (@browsercookies) lists 6 other indicators in this source. 2 are shown, chosen across types.

• Jiro Ya alias
• William Loy alias

All 7 indicators from this source

Cited by the same report: lazarus.group/team/damian-mularz

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 11 other indicators in this source. 2 are shown, chosen across types.

• Sergio Ramos alias
• https://t.me/damianmularz Telegram account

All 12 indicators from this source