Andy Hoog
Andy Hoog is an alias
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group) and Chollima Hunter.
The reporting files it under the persona Andy Hoog, alongside 6 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/andy-hoog — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. A GitLab account under toparc077, one of the logins attributed to this operator, displaying the name Andy Hoog and a member since 14 November 2018 — by some years the oldest account this sweep turned up. No bio, location or links.
gitlab.com/toparc077 — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.