Benjamin Nguyen
Also reported as: ponyjackal
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Benjamin Nguyen on call.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Identifiers attributed to this persona
8 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Benjamin Nguyen |
alias | |
benguyen0214@gmail.com |
email address | |
pony1125@outlook.com |
email address | |
vladimiru1125@gmail.com |
email address | |
ponyjackal.eth |
ens name | |
https://github.com/jonyx225 |
github profile | live |
https://github.com/ponyjackal |
github profile | removed |
https://x.com/ponyjackalx |
x account |
Benjamin Nguyen
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/benjamin-nguyen — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/jonyx225 is account id 47555611, created on 12 February 2019, with 222 public repositories. Its commits carry 47555611+ponyjackal@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/ponyjackal, renamed; that handle now returns not found. It signs 84 of the 100 commits GitHub's search returns for it with pony1125@outlook.com, an address the registry gives for Benjamin Nguyen, under the author names pony and ponyjackal.
github.com/jonyx225 — Chollima Hunter
benguyen0214@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/benjamin-nguyen — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Benjamin Nguyen - ponyjackal.eth - github.com/ponyjackal • [Archive](https://archive.ph/OV5Yd) - x.com/ponyjackalx - benguyen0214@gmail.com - Has JP Morgan Chase account through Rippling in his name - 0x5c411cb174c2e163f6465252ae895f3e3e5a8792 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
pony1125@outlook.com
email address IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/benjamin-nguyen — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/jonyx225 is account id 47555611, created on 12 February 2019, with 222 public repositories. Its commits carry 47555611+ponyjackal@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/ponyjackal, renamed; that handle now returns not found. It signs 84 of the 100 commits GitHub's search returns for it with pony1125@outlook.com, an address the registry gives for Benjamin Nguyen, under the author names pony and ponyjackal.
github.com/jonyx225 — Chollima Hunter
vladimiru1125@gmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/benjamin-nguyen — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
ponyjackal.eth
ens name IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/benjamin-nguyen — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/jonyx225
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/jonyx225 is account id 47555611, created on 12 February 2019, with 222 public repositories. Its commits carry 47555611+ponyjackal@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/ponyjackal, renamed; that handle now returns not found. It signs 84 of the 100 commits GitHub's search returns for it with pony1125@outlook.com, an address the registry gives for Benjamin Nguyen, under the author names pony and ponyjackal.
github.com/jonyx225 — Chollima Hunter
https://github.com/ponyjackal
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as ponyjackal
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/benjamin-nguyen — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…TUKiggXUD1frQRWPK3La13FifhvbDBReaA --- ## PONYJACKAL CLUSTER -  #### Benjamin Nguyen - ponyjackal.eth - github.com/ponyjackal • [Archive](https://archive.ph/OV5Yd) - x.com/ponyjackalx - benguyen0214@gmail.com - Has JP Morgan Chase account through Rippling in his…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://x.com/ponyjackalx
x account IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/benjamin-nguyen — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- lazarus.group/team/benjamin-nguyen — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- github.com/jonyx225 — Chollima Hunter