Chollima Hunter

← Remote Workers

wm111898@gmail.com

wm111898@gmail.com is an email address that 3 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group), Chollima Hunter and tayvano (lazarus-bluenoroff-research). The earliest of those reports is dated 2026-08-30 and the most recent 2026-10-18.

The reporting files it under the persona Lucas Wong, alongside 9 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

email address IT Worker Fraud CURATED

First seen 2026-08-30 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Lucas Wong / cox1118 / superlwclx / LucasWongC / c__x__” · pulled 2026-09-09
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/codeprom is account id 101302451, created on 10 March 2022, with 92 public repositories and 152 followers. Its commits carry 101302451+lucaswongc@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/lucaswongc, renamed; that handle now returns not found. It signs 59 of the 100 commits GitHub's search returns for it with wm111898@gmail.com, an address the registry gives for Lucas Wong.
    github.com/codeprom — Chollima Hunter · under “Lucas Wong” · pulled 2026-09-24

  • Nearby text:

    …t.me/cox1118 (ID: 5034927805) • ([Messages](./user-5034927805-@cox1118-Lucas-Wong.txt)) - lucas.wong.1118@gmail.com - wm111898@gmail.com - Discord: c__x__ - lucasw.net - 0xee52717e6dA13499a3C4ba803e4D952CF052704E - 0x94A8518B76A3c45F5387B521695024379d43d715 -…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Lucas Wong” · published 2025-06-19 · pulled 2026-08-30

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Same persona record: Lucas Wong

Other identifiers the reporting files under the same persona; 8 of 9 are shown.

All 9 on the Lucas Wong page

Cited by the same report: lazarus.group/team/lucas-wong

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 7 other indicators in this source. 1 are shown, chosen across types.

All 8 indicators from this source

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 3 are shown, chosen across types.

All 855 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.