milanzubic1120@gmail.com
milanzubic1120@gmail.com is an email address
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer).
The report is dated 2026-04-17.
The reporting files it under the persona Milan Zubic, alongside 18 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
email address IT Worker Fraud RESEARCHER POST
Source
-
A thirteen-part thread that links five identities by commit-email forensics: the GitHub account icetrust0212 and a deleted account trust0212 both authoring under one address, and a deleted trust0212-fantohm and a still-active resplegend both authoring under a second. The thread states that resplegend's commits are literally authored under the name trust0212-fantohm, which is the corroboration it rests the grouping on. The Milan Zubic name is the one the identity used on job applications. This persona is already recorded on this site from tayvano's research and from lazarus.group under the same name; the entries merge on the name and the address they share. The organisations named in the thread, including the project whose credential-verification code the thread says this developer wrote, are the parties affected by the work rather than indicators, and are not recorded as such. The thread was also republished on lazarus.day and captured on archive.today; the X post is cited here as the original. The address zaza.liveedu@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address milanzubic1120@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/meow_mfer/status/2045094199415238904 — meow mfer (@meow_mfer)
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.
Related indicators
Same persona record: Milan Zubic
All 18 on the Milan Zubic page