← Remote Workers

goldsea808@yahoo.com

goldsea808@yahoo.com is an email address that 3 published sources report in connection with IT Worker Fraud, Moonstone Sleet and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from tayvano (lazarus-bluenoroff-research) and Chollima Group. The earliest of those reports is dated 2025-08-25 and the most recent 2026-10-18.

email address IT Worker FraudMoonstone SleetDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …illia.butenko89@gmail.com - ddksniper@gmail.com - intellichain555@gmail.com - salbu15154@gmail.com - goldsea808@gmail.com - goldsea808@yahoo.com - mrsteevtvw418@gmail.com - ichiro@0xlancerlab.com - hanssuperdev1026@gmail.com - hansjkiller1026@outlook.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Misc” · published 2025-06-19 · pulled 2026-08-30

• …One additional pivot off of the goldsea808@yahoo.com[email protected] account led us to a LinkedIn profile for An AR/VR developer/project manager based out of Jilin, China (an area that…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “Opening Another.” · published 2025-08-25 · pulled 2026-09-11

• …Workers of BABYLONGROUP ended on a cliffhanger which briefly had us looking into a suspected IT Worker named Hailong Jin using the email goldsea808@yahoo.com[email protected] and username sujan198703 .…

  Bells Ringing in Dar es Salaam — Chollima Group · under “Introduction.” · published 2025-09-04 · pulled 2026-09-12

• …One additional pivot off of the goldsea808@yahoo.com account led us to a LinkedIn profile for An AR/VR developer/project manager based out of Jilin, China (an area that directly borders the…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “Opening Another.” · published 2025-08-25 · pulled 2026-10-18

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 5 are shown, chosen across types.

• https://calendly.com/codeninja819 Calendly account
• https://dev.to/david_wenske_0b5dfdc82e27 DEV Community account
• gombau1212@gmail.com email address
• https://fiverr.com/derekmiller03 Fiverr account
• https://freelancer.com/u/esoh0612 Freelancer.com account

All 855 indicators from this source

Cited by the same report: Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group

Chollima Group lists 109 other indicators in this source. 4 are shown, chosen across types.

• https://github.com/talented-blockchain-dev GitHub account
• 45.126.3.252 IP address
• https://laborx.com/freelancers/users/id328992 LaborX account
• https://www.linkedin.com/in/brent-jeremy-47172b22a/ LinkedIn account

All 110 indicators from this source

Cited by the same report: Bells Ringing in Dar es Salaam

Chollima Group lists 44 other indicators in this source. 3 are shown, chosen across types.

• https://github.com/intellichain555 GitHub account
• 173.208.245.144 IP address
• https://www.linkedin.com/in/lian-hung-129b47158/ LinkedIn account

All 45 indicators from this source