← Remote Workers

https://github.com/0xm00neth

https://github.com/0xm00neth is a GitHub account that 3 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group) and tayvano (lazarus-bluenoroff-research). The earliest of those reports is dated 2026-08-30 and the most recent 2026-10-18.

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-08-30

Listed as 0xm00neth

Listed under Jason Kwon, Jason Lee.

First seen 2026-08-30 · last seen 2026-10-18

Sources

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Jason Kwon / 0xMoon / 0xm00n / 0xm00n.eth / 0xm00neth / cryptonerd_ / 0xlock” · pulled 2026-09-09

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Jason Lee / punk1004 / jasonlee9627 / 0xJason” · pulled 2026-09-09

• Nearby text:

  …Beanstalk, Blueberry, Spice Finance, - 0xMoon - 0xm00n - 0xm00n.eth - 0xm00neth - cryptonerd_ - 0xm00neth@gmail.com - 0xlock - github.com/0xm00neth • [Archive](https://archive.ph/WIu3i) - github.com/0xlock • [Archive](https://archive.ph/J347l) - x.com/0xm00neth -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Jason Kwon” · published 2025-06-19 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Same persona record: Jason Kwon

Other identifiers the reporting files under the same persona; 4 of 17 are shown.

• Jason Kwon alias
• https://hub.docker.com/u/0xlock Docker Hub account
• 0xm00neth@gmail.com email address
• https://trello.com/u/0xlock Trello account

All 17 on the Jason Kwon page

Same persona record: Jason Lee

Other identifiers the reporting files under the same persona; 4 of 6 are shown.

• Jason Lee alias
• https://dev.to/0xm00neth DEV Community account
• https://gitlab.com/0xm00neth GitLab account
• https://x.com/0xm00neth X account

All 6 on the Jason Lee page

Cited by the same report: lazarus.group/team/jason-kwon

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 13 other indicators in this source. 2 are shown, chosen across types.

• 0x03e6adb71ec39af3d68733f1c3f5e54e6e55b7d2 cryptocurrency wallet address
• 0x4b94ba1528636a699dab486a217d39bb7ce21d75 cryptocurrency wallet address

All 14 indicators from this source

Cited by the same report: lazarus.group/team/jason-lee

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 4 other indicators in this source. 1 are shown, chosen across types.

• jasonlee9627@gmail.com email address

All 5 indicators from this source

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 1 are shown, chosen across types.

• https://calendly.com/zerobit417 Calendly account

All 855 indicators from this source