← Remote Workers

https://github.com/0xl2

https://github.com/0xl2 is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from tayvano (lazarus-bluenoroff-research). The earliest of those reports is dated 2026-08-30 and the most recent 2026-10-18.

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-08-30

Listed as 0xl2

First seen 2026-08-30 · last seen 2026-10-18

Source

• Nearby text:

  …0xl2 - jigoat - zeroxjoe - x.com/zeroxjoe - 0xl2@proton.me - leon.lowden7@gmail.com - github.com/0xl2 • [Archive](https://archive.ph/KolKd) - 0x0c0e8ef4b62a4a2a1b5031911e272362530c1a9a - 0xfd1b05e51653339c850c8a18c9ac11aed9105f2a ####…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Leon - Leon Lowden (0xl2)” · published 2025-06-19 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 12 are shown, chosen across types.

• https://calendly.com/codeninja819 Calendly account
• https://dev.to/david_wenske_0b5dfdc82e27 DEV Community account
• alexdavisang@gmail.com email address
• https://fiverr.com/derekmiller03 Fiverr account
• https://freelancer.com/u/esoh0612 Freelancer.com account
• https://freelancermap.com/profile/denis-rudink freelancermap account
• https://github.com/0xllach GitHub account
• 204.44.106.96 IP address
• https://laborx.com/freelancers/users/id126269 LaborX account
• https://www.linkedin.com/in/andy-hoog/ LinkedIn account
• https://linktr.ee/codeninja819 Linktree account
• https://medium.com/@cryptosavingexpert Medium account

All 855 indicators from this source