luckyguys.site
luckyguys.site is a domain
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from ZachXBT (@zachxbt).
The report is dated 2026-04-08.
domain IT Worker Fraud RESEARCHER POST
Registration
| Registered | 2025-12-02 |
|---|---|
| Registrar | HOSTINGER operations, UAB |
| Expires | 2028-12-02 |
| Last changed | 2025-12-07 |
| Status | client transfer prohibited |
Sources
-
Recovered from IPMsg chat logs on a DPRK IT worker's device after it was compromised by an infostealer. The researcher describes the site as an internal payment remittance platform, a Discord-style messenger the workers used to report payments back to their handlers. It is infrastructure rather than an identity, and the post attributes it to no individual operator.
x.com/zachxbt/status/2041873511791345774 — ZachXBT (@zachxbt) -
Data taken from an internal North Korean payment server and passed to the researcher by an unnamed source, covering 390 accounts along with chat logs and transactions. The site named in the chat logs was an internal remittance platform whose default password had gone unchanged for ten of its users; it was taken down the day after the thread was published. The researcher describes tracing the two payment addresses on-chain to IT workers already attributed to known clusters, and reports that the Tron address was frozen by Tether in December 2025. The addresses belong to the payment infrastructure rather than to any one operator, which is why they are recorded without a persona. The administrative panel was read on 16 September 2026 from the screenshot in the third post of the thread, which is the first time any of the 390-account list has been transcribed here. Fifteen rows are legible and they are ordinary in a way worth recording: a username, a display name and a free-text description, with a single account -- username admin, display name PC-1234 -- holding the administrator flag. Five of the fifteen describe a post in an organisation. One writes "I am manager of 1020 team" and another "1020 vice manager"; a third "I am a chief of 710 Command department"; a fourth "I am a boss of PNI team"; and an account named admiral gives its description as "Head of Polaris-171". Those unit names -- 1020, 710 Command Department, PNI, Polaris-171 -- appear nowhere else in this repository and are recorded exactly as the panel prints them, without any claim about what they denote. The remaining rows carry no description at all. The fifth post adds the conversion route: a Payoneer confirmation dated 19 February 2026 moving 495 euro out of a balance held by a company named Grack Birds LLC into a Citibank account, which is the fiat leg of the remittance pattern the post describes. The organizational chart was read on the same day and did not need the password: the sixth post of the thread screenshots it whole and it is legible. Its header gives the scope -- 390 accounts, 214 of them with chat logs, 8 December 2025 to 28 February 2026, and total payments of 2.84 million dollars over that window -- and describes itself as derived from the server export together with an analysis of the logs. The shape is a single administrator over a single command department over three columns of groups. At the top is PC-1234, described as managing all payment accounts and confirming all team remittances, with the Ethereum address already recorded here printed beneath it. Below that sits the 710 Command Department, whose chief is the account 710_TJ under the name JiHuiBu. Everything else hangs off that. Twenty groups are filed as operational units: Unit 1020, which at 920,000 dollars across two accounts is by far the largest single payer in the chart, Bureau 128 at 396,000 across sixteen accounts, RedStar at 323,000 across two, then Second Economy, UOS, Polaris-171, JaeJong-Central, PUCS Info Exchange, Sobaeksu, CIC, HangLo 2nd, PBIC, Unit 418, BH-2401, Kuksol, RB Team, BH-1383, JKIC, RR888 and MOF. Eight are filed as regional groups and they are North Korean places: ChongJin, HamHung and Hamnam, North Hamgyong, PyongSong, North and South Hwanghae, Rason and Wonsan, Ryanggang, and a catch-all called Other Regions which is the largest of them at 120,000 dollars over ten accounts. Twenty more are filed by sector or industry: Various and Miscellaneous, University of Transport, Kanggye Forest IT, Print Teams, Jonsong-Moran, ChongSoNyon, Health IT, HUCE, Kumgangsan2005, Madusan, 325-Sollim, HNIC, Myohyang, Munhung Tech, Natural Museum, Jae Ryong, SonKwang Trading, Ryonbong, SukChon and 3556 Army-126. Two carry an OFAC SDN tag in the chart itself, Sobaeksu and SonKwang Trading, and the post's text says three of the companies appearing in the data are currently sanctioned, the third being in the part of the text the syndication endpoint truncates. None of this is an indicator and none of it is recorded as one: it is the researcher's reconstruction of a hierarchy from an exfiltrated database, the group names are what the database called them, and what any of them denotes outside this chart is not something this site establishes.
x.com/zachxbt/status/2041873511791345774 — ZachXBT (@zachxbt)
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.