`https://github.com/zhmoly`

https://github.com/zhmoly is a GitHub account that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group) and tayvano (lazarus-bluenoroff-research). The earliest of those reports is dated 2026-08-30 and the most recent 2026-10-18.

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-08-30

Listed as zhmoly

Listed under Sadao Eiichi Murano, John Wilhelmson.

First seen 2026-08-30 · last seen 2026-10-18

removed checked 2026-08-30

Sources

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Sadao Eiichi Murano / John Wilhelmsson / zhmolly / zhmoly / dainmoly / 9omo6” · pulled 2026-09-09
…John Wilhelmson / zhmolly - 2021 - Shows up all over zhmolly handles - John Wilhelmsson - JeyHop - jwtradera - zhmoly - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “John Wilhelmson / zhmolly” · published 2025-06-19 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Same persona record: Sadao Eiichi Murano

Other identifiers the reporting files under the same persona; 4 of 13 are shown.

All 13 on the Sadao Eiichi Murano page

Same persona record: John Wilhelmson

Other identifiers the reporting files under the same persona; 4 of 5 are shown.

All 5 on the John Wilhelmson page

Cited by the same report: lazarus.group/team/john-wilhelmsson

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 12 other indicators in this source. 3 are shown, chosen across types.

All 13 indicators from this source

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 1 are shown, chosen across types.

All 855 indicators from this source