Ronnie Holt

Ronnie Holt is an alias that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from ZEUS-DEV-919 working document.

The reporting files it under the persona Rui Kishimoto, alongside 10 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. This persona is documented elsewhere in the repository already and the document is a second, independent compilation of the same accounts. It adds that the identity's profile pictures are photographs of a South Korean actor, which is why that actor stays in the held-back list: he is the subject of stolen images and is not accused of anything.
    docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Rui Kishimoto / Hot Cappuchino / Ronnie Holt” · pulled 2026-09-09

Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.

Related indicators

Same persona record: Rui Kishimoto

Other identifiers the reporting files under the same persona; 8 of 10 are shown.

All 10 on the Rui Kishimoto page

Cited by the same report: docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit

ZEUS-DEV-919 working document lists 51 other indicators in this source. 4 are shown, chosen across types.

All 52 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.