`trevorgreer9312@gmail.com`

trevorgreer9312@gmail.com is an email address that 6 published sources report in connection with Contagious Interview, IT Worker Fraud and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from SentinelOne, Silent Push, NKInternet and Flashpoint. The earliest of those reports is dated 2025-02-25 and the most recent 2025-12-16.

email address Contagious Interview IT Worker Fraud APT38 MATCHED IN SOURCE

First seen 2025-02-25 · last seen 2025-12-16

Sources

Nearby text:

…96054@gmail.com rodriguezjamesdaniel0807@gmail.com rv882866.hstgr.cloud@glitchmedic.com sinbad@hirelytics360.com thedrgn1011@gmail.com trevorgreer9312@gmail.com yudaiaoyama14@gmail.com IP Addresses Value Note 181.215.9.29 Used for account registration and logging into Validin…
Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms | SentinelOne — SentinelOne · under “Indicators of Compromise” · published 2025-09-04 · pulled 2026-08-30
Nearby text:

…(SI) satoshiyama14@gmail.com (ST) richardkdavis45@gmail.com (AC) thedron101@gmail.com (CT) fairdev610@gmail.com @ trevorgreer9312@gmail.com (JA) The Trevor Greer persona has been heavily documented as being associated with the North Korean “Contagious Interview” threat…
Silent Push uncovered Contagious Interview front company scam — Silent Push · under “Investigating the C2 Domain “camdriversupport.com”” · published 2025-04-24 · pulled 2026-09-12
…Hudson Rock detailed information derived from infostealer logs tied to activity associated with the Trevor Greer persona, you know the one trevorgreer9312@gmail.com.…
Additional Notes on the Trevor Greer Infostealer Logs — NKInternet · under “Additional Notes on the Trevor Greer Infostealer Logs” · published 2025-12-16 · pulled 2026-09-12
…This domain is connected to the email address trevorgreer9312@gmail.com, which was used in previous Lazarus attacks. The name “Lazaro” was identified in the logs as part of a test entry that the threat actors…
Silent Push Pivots into New Lazarus Group Infrastructure, Acquires Sensitive Intel Related to $1.4B ByBit Hack and Past Attacks — Silent Push · under “Key Findings” · published 2025-02-25 · pulled 2026-09-12
…domain registered hours before the $1.4 billion ByBit heist – “bybit-assessment.com” – which had WHOIS records showing the email address “trevorgreer9312@gmail.com,” was used to register the domain.…
Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors — Silent Push · under “Test Logs Confirm Lazarus Subgroup “Contagious Interview” Still Using Astrill VPN IPs” · published 2025-02-28 · pulled 2026-09-12
…In the aftermath, Silent Push researchers identified the persona “Trevor Greer” associated with the email address trevorgreer9312@gmail.com, which registered the domain “Bybit-assessment.com” prior to the Bybit compromise. A later report claimed that the domain…
Beyond the Malware: Inside the Digital Empire of a North Korean Threat Actor — Flashpoint · under “ByBit Compromise” · published 2025-12-10 · pulled 2026-09-12

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Cited by the same report: Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms | SentinelOne

SentinelOne lists 45 other indicators in this source. 5 are shown, chosen across types.

All 46 indicators from this source

Cited by the same report: Silent Push uncovered Contagious Interview front company scam

Silent Push lists 88 other indicators in this source. 4 are shown, chosen across types.

All 89 indicators from this source

Cited by the same report: Additional Notes on the Trevor Greer Infostealer Logs

NKInternet lists 2 other indicators in this source.