← Remote Workers

https://github.com/bluechamel

https://github.com/bluechamel is a GitHub account that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group) and tayvano (lazarus-bluenoroff-research). The earliest of those reports is dated 2026-08-30 and the most recent 2026-10-18.

github profile IT Worker Fraud MATCHED IN SOURCE live checked 2026-08-30

Listed as bluechamel

Listed under Mauro Liu, Mauro Liu aka Xu Liu.

First seen 2026-08-30 · last seen 2026-10-18

live checked 2026-08-30

The image is the avatar this account displays, not evidence of who operates it.

Sources

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/mauro-liu — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Mauro Liu / Xu Liu / 0xchamel / 0xllaCh / blueChamel / chamel92 / daiki-iu / Gornutz / lmauro77 / mauroh.perk / mauroliu77 / zhChamel / zhChameleon / bitbaby888 / imyugioh / zhExcal / 0xlocker / ethlocker / raptor1001” · pulled 2026-09-09

• Nearby text:

  …github.com/0xlocker • [Archive](https://web.archive.org/web/20210309195053/https://github.com/0xlocker) - github.com/blueChamel • [Archive](https://web.archive.org/web/20250827055005/https://github.com/blueChamel) - github.com/ethlocker (name: Hack the Moon!) •…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Mauro Liu aka Xu Liu” · published 2025-06-19 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Commit addresses this index holds

• mauro@blueberry.garden

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-01. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: Mauro Liu

Other identifiers the reporting files under the same persona; 4 of 38 are shown.

• Derek Lee alias
• blueraptor1001@gmail.com email address
• https://www.linkedin.com/in/lmauro77/ LinkedIn account
• https://t.me/chamel92 Telegram account

All 38 on the Mauro Liu page

Same persona record: Mauro Liu aka Xu Liu

Other identifiers the reporting files under the same persona; 4 of 20 are shown.

• choilink227@gmail.com email address
• jamshedlatipov@gmail.com email address
• https://github.com/harmony-one GitHub account
• https://t.me/lladefa Telegram account

All 20 on the Mauro Liu aka Xu Liu page

Cited by the same report: lazarus.group/team/mauro-liu

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 23 other indicators in this source. 3 are shown, chosen across types.

• mauroh.perk alias
• mauro@blueberry.garden email address
• https://github.com/ethlocker GitHub account

All 24 indicators from this source

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 1 are shown, chosen across types.

• https://calendly.com/codeninja819 Calendly account

All 855 indicators from this source