`mauro@blueberry.garden`

mauro@blueberry.garden is an email address that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group) and tayvano (lazarus-bluenoroff-research). The earliest of those reports is dated 2026-08-30 and the most recent 2026-10-18.

email address IT Worker Fraud MATCHED IN SOURCE

Listed under Mauro Liu, Mauro Liu aka Xu Liu.

First seen 2026-08-30 · last seen 2026-10-18

Sources

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/mauro-liu — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Mauro Liu / Xu Liu / 0xchamel / 0xllaCh / blueChamel / chamel92 / daiki-iu / Gornutz / lmauro77 / mauroh.perk / mauroliu77 / zhChamel / zhChameleon / bitbaby888 / imyugioh / zhExcal / 0xlocker / ethlocker / raptor1001” · pulled 2026-09-09
Nearby text:

…Burndai, Derek Lee, Raptor, Raptor1001, burndai, ethlocker, unlocker - choi.link227@gmail.com: Ryan Choi - bitbaby888@gmail.com - mauro@blueberry.garden (blueChamel) - pwongexcal@gmail.com (0xchamel) - zhaoa4317@gmail.com (zhChameleon) - t.me/chamel92 (ID: 6635242888) •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Mauro Liu aka Xu Liu” · published 2025-06-19 · pulled 2026-08-30

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Same persona record: Mauro Liu

Other identifiers the reporting files under the same persona; 4 of 38 are shown.

All 38 on the Mauro Liu page

Same persona record: Mauro Liu aka Xu Liu

Other identifiers the reporting files under the same persona; 4 of 20 are shown.

All 20 on the Mauro Liu aka Xu Liu page

Cited by the same report: lazarus.group/team/mauro-liu

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 23 other indicators in this source. 3 are shown, chosen across types.

All 24 indicators from this source

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 1 are shown, chosen across types.

All 855 indicators from this source