Danny Jin

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/ssmith542 is account id 48925763, created on 25 March 2019. Of the 100 commits GitHub's search returns for it, 31 are signed dannyjin117@gmail.com and 6 as5179000@gmail.com, and 56 are signed with its own noreply address under the former handles dansofter and webninja1992; a further six commits in its repositories are signed webninja16@gmail.com. lazarus.group gives all three of those mailboxes for Danny Jin. The commits carry the author names Danny, danny-biztree, topdev17 and dansofter, and are made on the day each repository is created.

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/ssmith542 is account id 48925763, created on 25 March 2019. Of the 100 commits GitHub's search returns for it, 31 are signed dannyjin117@gmail.com and 6 as5179000@gmail.com, and 56 are signed with its own noreply address under the former handles dansofter and webninja1992; a further six commits in its repositories are signed webninja16@gmail.com. lazarus.group gives all three of those mailboxes for Danny Jin. The commits carry the author names Danny, danny-biztree, topdev17 and dansofter, and are made on the day each repository is created.

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/ssmith542 is account id 48925763, created on 25 March 2019. Of the 100 commits GitHub's search returns for it, 31 are signed dannyjin117@gmail.com and 6 as5179000@gmail.com, and 56 are signed with its own noreply address under the former handles dansofter and webninja1992; a further six commits in its repositories are signed webninja16@gmail.com. lazarus.group gives all three of those mailboxes for Danny Jin. The commits carry the author names Danny, danny-biztree, topdev17 and dansofter, and are made on the day each repository is created.

Nearby text:

… - https://x.com/zachxbt/status/1940388827392344261 -  #### Danny Jin - dannyjin117@gmail.com - 0xacb8ba726c04408aecacd6794b4c9dc59652203d -  - https://x.com/zachxbt/status/1940388827392344261 #### Muhammad…

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/ssmith542 is account id 48925763, created on 25 March 2019. Of the 100 commits GitHub's search returns for it, 31 are signed dannyjin117@gmail.com and 6 as5179000@gmail.com, and 56 are signed with its own noreply address under the former handles dansofter and webninja1992; a further six commits in its repositories are signed webninja16@gmail.com. lazarus.group gives all three of those mailboxes for Danny Jin. The commits carry the author names Danny, danny-biztree, topdev17 and dansofter, and are made on the day each repository is created.

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/ssmith542 is account id 48925763, created on 25 March 2019. Of the 100 commits GitHub's search returns for it, 31 are signed dannyjin117@gmail.com and 6 as5179000@gmail.com, and 56 are signed with its own noreply address under the former handles dansofter and webninja1992; a further six commits in its repositories are signed webninja16@gmail.com. lazarus.group gives all three of those mailboxes for Danny Jin. The commits carry the author names Danny, danny-biztree, topdev17 and dansofter, and are made on the day each repository is created.

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.