Chollima Hunter

← Remote Workers

wsarah0808@gmail.com

wsarah0808@gmail.com is an email address that 7 published sources report in connection with APT37 and IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from AhnLab ASEC, Genians and DTEX Systems. The earliest of those reports is dated 2024-03-27 and the most recent 2025-05-14.

email address APT37IT Worker Fraud MATCHED IN SOURCE

Listed as w.sarah0808@gmail.com

First seen 2024-03-27 · last seen 2025-05-14

Sources

  • Nearby text:

    …분석 과정에서 확인된 공격자의 이메일 주소는 다음과 같다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com ASEC에서는 자사 블로그를 통해 악성 바로 가기 파일에 대해 꾸준히 공유해 온 만큼 해당 악성코드의 유포가 빈번하게 확인되고 있다.…
    RokRAT 악성코드를 유포하는 LNK 파일 (수료증 위장) - ASEC — AhnLab ASEC · under “RokRAT 악성코드를 유포하는 LNK 파일 (수료증 위장)” · published 2024-04-23 · pulled 2026-09-11

  • Nearby text:

    …of the threat actor identified during the analysis process are as follows. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com Through its blog, ASEC has been consistently sharing information about the distribution of malicious shortcut…
    LNK File Disguised as Certificate Distributing RokRAT Malware - ASEC — AhnLab ASEC · under “LNK File Disguised as Certificate Distributing RokRAT Malware” · published 2024-04-22 · pulled 2026-09-11

  • Nearby text:

    …Email w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com 이 글 공유하기…
    APT37 그룹의 RoKRAT 파일리스 공격 증가 — Genians · under “6. 주요 침해 지표 (Indicator of Compromise)” · published 2024-03-27 · pulled 2026-09-11

  • Nearby text:

    …disclosed five Gmail accounts used by the threat actor. Gmail Addresses tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ Username searches based on the Yandex email addresses returned LinkedIn…
    Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation. ToyBox Story) — Genians · under “5-1. Traces of the Threat Actor” · published 2025-05-12 · pulled 2026-09-11

  • Nearby text:

    …식별됐던 대표적인 이메일 계정은 다음과 같습니다. tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 'panic.dat' 파일은 Shellcode 루틴을 통해 암호화된 RoKRAT 모듈이 실행됩니다. [그림 4-2] Shellcode 디코딩…
    APT37 위협 배후의 사이버 정찰 활동 분석 — Genians · under “3. 유사 악성프로그램 (Similar malware)” · published 2024-11-05 · pulled 2026-09-12

  • Nearby text:

    …배후의 사이버 정찰 활동 분석 ' 보고서를 통해 위협 행위자가 사용한 5개의 구글 지메일 계정이 공개된 바 있습니다. 지메일(Gmail) 주소 tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com ○ 얀덱스 이메일에 사용된 아이디를 검색하면, 동일 이름의 링크드인 이용자가 일부 조회됩니다.…
    한국 국가안보전략 싱크탱크 위장 APT37 공격 사례 분석 (작전명. 토이박스 스토리) — Genians · under “5-1. 위협 행위자(Threat Actor)의 흔적” · published 2025-05-12 · pulled 2026-09-12
  • Per DTEX's own advisory text: these IOCs are NOT indicative of a confirmed North-Korea-attributed hack — they may have associations with IT-worker operations and require further investigation if observed in your environment. Any connection to actual persons may be deliberate (an operator using a real person's identity) or incidental, and the actual owner of an email account listed here may be unaware their address is associated with this IOC list. Do not treat presence on this list as proof of wrongdoing by the account holder.
    i3 Threat Advisory: Identifying North Korean IT Workers: Key Threat Indicators — DTEX Systems · published 2025-05-14 · pulled 2026-10-26

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Cited by the same report: RokRAT 악성코드를 유포하는 LNK 파일 (수료증 위장) - ASEC

AhnLab ASEC lists 8 other indicators in this source. 5 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: LNK File Disguised as Certificate Distributing RokRAT Malware - ASEC

AhnLab ASEC lists 8 other indicators in this source. 3 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: APT37 그룹의 RoKRAT 파일리스 공격 증가

Genians lists 5 other indicators in this source. 4 are shown, chosen across types.

All 6 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.