← Remote Workers

departmentc0809@gmail.com

departmentc0809@gmail.com is an email address that 2 published sources report in connection with IT Worker Fraud and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from tayvano (lazarus-bluenoroff-research) and Kieran Miyamoto (kmsec). The earliest of those reports is dated 2026-03-17 and the most recent 2026-10-18.

email address IT Worker FraudContagious Interview MATCHED IN SOURCE

Listed as department.c0809@gmail.com

First seen 2026-03-17 · last seen 2026-10-18

Sources

• Nearby text:

  …at: Gliwicka 95, Katowice, Silesian, 40-855, PL ### akratos_god - akratos_god - kratos-te - x.com/akratos_god - github.com/kratos-te - department.c0809@gmail.com - michaelgordon.kratos@gmail.com - nightfurry090@gmail.com - degenpigg - miclegoden - LOVES to leak the private code which earned him a…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “akratos_god” · published 2025-06-19 · pulled 2026-08-30

• …ja.vierj.ea.n.070 (ja.vierj.ea.n.070@googlemail.com) es-lint-entry-1.0.0.tgz 2026-03-16 10:07:53 npm-doc-deploy (v1.0.2) nomedicine999 (department.c0809@gmail.com) npm-doc-deploy-1.0.2.tgz exfil: polymarket-cli-testing.vercel.app 2026-03-16 08:49:30 bignum-ts-v2 (v5.0.3) nomedicine999…

  Contagious Trader campaign - Coordinated weaponisation of cryptocurrency trading bots by suspected DPRK malware operators | kmsec.uk — Kieran Miyamoto (kmsec) · under “npm packages” · published 2026-03-17 · pulled 2026-09-09

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 7 are shown, chosen across types.

• https://calendly.com/zerobit417 Calendly account
• https://dev.to/scott_brown_b611d05a865cf DEV Community account
• derek.miller03@outlook.com email address
• https://fiverr.com/derekmiller03 Fiverr account
• https://freelancer.com/u/spectrecoder Freelancer.com account
• https://freelancermap.com/profile/denis-rudink freelancermap account
• https://github.com/devsirius51 GitHub account

All 855 indicators from this source

Cited by the same report: Contagious Trader campaign - Coordinated weaponisation of cryptocurrency trading bots by suspected DPRK malware operators | kmsec.uk

Kieran Miyamoto (kmsec) lists 34 other indicators in this source. 5 are shown, chosen across types.

• cloudflareinsights.vercel.app domain
• digoschristiann@gmail.com email address
• https://github.com/leonyx007 GitHub account
• eslint-helper.vercel.app hosted site
• 87.120.102.178 IP address

All 35 indicators from this source