← Remote Workers

https://t.me/janbuidl

https://t.me/janbuidl is a Telegram account that 3 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group) and tayvano (lazarus-bluenoroff-research). The earliest of those reports is dated 2026-09-01 and the most recent 2026-10-18.

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as janbuidl

Listed under Janul Azwan, Jannik Villostas.

First seen 2026-09-01 · last seen 2026-10-18

Sources

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Jannik Villostas / 0xtomoon / mrcontract17877 / Henry Amin / gonzalodecruz / shoyano / vaccode365” · pulled 2026-09-09

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Janul Azwan / 0xtomoon / ethprotector” · pulled 2026-09-09

• …linkedin.com/in/janul-azwan-7b1612361/ - immunefi.com/profile/ethprotector/ - t.me/janbuidl (ID:7245484067) • ([Messages](./user-7245484067-@janbuidl-@mrcontract17877-@0xtomoon-Jannik-Villostas.txt)) #### Peter Wang - 2025 -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Janul Azwan” · published 2025-06-19 · pulled 2026-09-01

Find this indicator in the index, or see every Telegram account this site holds under Telegram accounts in the browse listing.

Related indicators

Same persona record: Janul Azwan

Other identifiers the reporting files under the same persona; 4 of 6 are shown.

• ethprotector alias
• melonman913@gmail.com email address
• https://github.com/0xtomoon GitHub account
• https://www.linkedin.com/in/janul-azwan-7b1612361/ LinkedIn account

All 6 on the Janul Azwan page

Same persona record: Jannik Villostas

Other identifiers the reporting files under the same persona; 4 of 8 are shown.

• gonzalodecruz alias
• Jannik Villostas alias
• shoyano alias
• https://x.com/mrcontract17877 X account

All 8 on the Jannik Villostas page

Cited by the same report: lazarus.group/team/jannik-villostas

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 8 other indicators in this source. 2 are shown, chosen across types.

• Henry Amin alias
• 0x1febc069606abfba5d021ed3768cb5d90c9407d5 cryptocurrency wallet address

All 9 indicators from this source

Cited by the same report: lazarus.group/team/janul-azwan

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 5 other indicators in this source. 1 are shown, chosen across types.

• Janul Azwan alias

All 6 indicators from this source

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 1 are shown, chosen across types.

• https://calendly.com/codeninja819 Calendly account

All 855 indicators from this source