`laytonhartcool@gmail.com`

laytonhartcool@gmail.com is an email address that 3 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from ZEUS-DEV-919 working document, Chollima Hunter and The Raven File. The earliest of those reports is dated 2025-08-19 and the most recent 2026-09-24.

The reporting files it under the persona Layton Hart, alongside 3 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

email address IT Worker Fraud CURATED

Listed as layton.hart.cool@gmail.com

First seen 2025-08-19 · last seen 2026-09-24

Sources

Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The number is the same one the table gives against two other names, a link the document does not draw itself.
docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Layton Hart” · pulled 2026-09-09
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 3 commits signed layton.hart.cool@gmail.com, an address the ZEUS-DEV-919 working document publishes for this persona, to the login Fly-Pig00, which no longer resolves.
github.com/Fly-Pig00 — Chollima Hunter · under “Layton Hart” · pulled 2026-09-24
Nearby text:

…mareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Same persona record: Layton Hart

Other identifiers the reporting files under the same persona.

Cited by the same report: docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit

ZEUS-DEV-919 working document lists 51 other indicators in this source. 4 are shown, chosen across types.

All 52 indicators from this source

Cited by the same report: Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags

The Raven File lists 1,741 other indicators in this source. 5 are shown, chosen across types.

All 1,742 indicators from this source