artur.dranhoi@exiod.io
artur.dranhoi@exiod.io is an email address
that 3 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group), Chollima Hunter and tayvano (lazarus-bluenoroff-research).
The earliest of those reports is dated 2026-08-30 and the most recent 2026-10-18.
email address IT Worker Fraud CURATED
Listed under Daniel Salo, Oleksandr Muravskyi.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/oleksandr-muravskyi — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.
github.com/princecharming0115 — Chollima Hunter -
…0xa8cb25ddf0a7195bdc3232ac6e1d812c8a4713fe #### Oleksandr Muravskyi (aka Artur Dranhoi) - oleksandr-muravskyi - PrinceCharming0115 - artur.dranhoi@exiod.io - coolprince0115@gmail.com - ole.dev300@hotmail.com - olek.muravskyi@outlook.com #### Joel Kursala -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.
Related indicators
Same persona record: Daniel Salo
Same persona record: Oleksandr Muravskyi
All 6 on the Oleksandr Muravskyi page
Cited by the same report: lazarus.group/team/oleksandr-muravskyi
All 7 indicators from this source
Cited by the same report: github.com/princecharming0115
All 4 indicators from this source