Damian Mularz
Also reported as: Tony GuoSergio RamosDreamHighNetdragon9860xwhizЕвгений Панов
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Screenshot”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Profiles and evidence
Identity document published by the registry under this persona, captioned there as “Front of fake Polish ID card”. The registry presents it as a document used for this identity. Its name, number and photograph are the document's own and may belong to a real person whose identity was stolen to build the persona.
Identity document published by the registry under this persona, captioned there as “Back of fake Polish ID card”. The registry presents it as a document used for this identity. Its name, number and photograph are the document's own and may belong to a real person whose identity was stolen to build the persona.
Files published with this identity
| File | Description | Size | Published by |
|---|---|---|---|
| damian_mularz_cv.pdf | Damian Mularz CV | 99 KB | Lazarus Group DPRK IT-Worker Registry (lazarus.group) |
Identifiers attributed to this persona
14 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Damian Mularz |
alias | |
DreamHigh |
alias | |
Sergio Ramos |
alias | |
Tony Guo |
alias | |
Евгений Панов |
alias | |
cuiguo23@gmail.com |
email address | |
damianmularz725@gmail.com |
email address | |
evgenpan228@gmail.com |
email address | |
netdragon986@gmail.com |
email address | |
https://github.com/0xwhiz |
github profile | live |
https://github.com/evgpan |
github profile | live |
https://gitlab.com/evgpan |
gitlab account | live |
+48667729989 |
phone number | |
https://t.me/damianmularz |
telegram account | live |
Damian Mularz
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. A GitLab account exists under evgpan, one of the logins the registry gives for this operator. It carries no bio, no location and no links, and states only a display name in Cyrillic, Евгений Панов — which transliterates as Evgeny Panov, a reading of this site's own and not something the page says — and a member-since date of 6 February 2024. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/EvgPan — Chollima Hunter
DreamHigh
alias IT Worker Fraud RESEARCHER POST
Also listed under William Loy — this value’s page names all of them.
Sources
-
The same foxcorp organisation prompt appears on the GitHub profile in the Axiom 88 entry, captured by the same researcher two days earlier.
x.com/browsercookies/status/1923549354025234903 — Cookie Connoisseur (@browsercookies) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sergio Ramos
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Tony Guo
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Евгений Панов
alias IT Worker Fraud CURATED
Source
-
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. A GitLab account exists under evgpan, one of the logins the registry gives for this operator. It carries no bio, no location and no links, and states only a display name in Cyrillic, Евгений Панов — which transliterates as Evgeny Panov, a reading of this site's own and not something the page says — and a member-since date of 6 February 2024. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/EvgPan — Chollima Hunter
cuiguo23@gmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
damianmularz725@gmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
evgenpan228@gmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
netdragon986@gmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/0xwhiz
github profile IT Worker Fraud THIRD-PARTY REGISTRY live
live
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/evgpan
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as evgpan
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…for jobs in April 2025. - https://x.com/browsercookies/status/1933686204668784823 -  #### SolDev - github.com/evgpan - https://x.com/browsercookies/status/1933686204668784823 -  #### Grin - github.com/Grin0502 •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://gitlab.com/evgpan
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. A GitLab account exists under evgpan, one of the logins the registry gives for this operator. It carries no bio, no location and no links, and states only a display name in Cyrillic, Евгений Панов — which transliterates as Evgeny Panov, a reading of this site's own and not something the page says — and a member-since date of 6 February 2024. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/EvgPan — Chollima Hunter
+48667729989
phone number IT Worker Fraud THIRD-PARTY REGISTRY
Line type
| Line type | Wireless |
|---|---|
| Carrier | POLKOMTEL S.A. |
| Rate centre | POLAND |
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://t.me/damianmularz
telegram account IT Worker Fraud THIRD-PARTY REGISTRY live
live
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- x.com/browsercookies/status/1923549354025234903 — Cookie Connoisseur (@browsercookies)
- lazarus.group/team/damian-mularz — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- gitlab.com/EvgPan — Chollima Hunter