Dustin Lee

Also reported as: Timothy MorrisJonathan Willis0xguardstateguardstates

A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's.

IT Worker Fraud

LinkedIn accounts

Identifiers reported alongside

10 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Dustin Lee alias —
Jonathan Willis alias —
Timothy Morris alias —
0xguardstate@proton.me email address —
dustinleecog@gmail.com email address —
ijonathanwillis@gmail.com email address —
timmorrisdefi@outlook.com email address —
https://github.com/0xguardstate github profile live checked 2026-09-02
+18033390164 phone number —
https://t.me/guardstates telegram account live checked 2026-11-08

Dustin Lee

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

Jonathan Willis

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

Timothy Morris

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

0xguardstate@proton.me

email address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

dustinleecog@gmail.com

email address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

ijonathanwillis@gmail.com

email address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

timmorrisdefi@outlook.com

email address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

https://github.com/0xguardstate

github profile IT Worker Fraud THIRD-PARTY REGISTRY live checked 2026-09-02

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

+18033390164

phone number IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Line type

Line typeVoIP
CarrierGOOGLE VOICE
Rate centreMILL CREEK, SC

Looked up 2026-09-13 at localcallingguide.com and phonevalidator.com. This is a lookup of the line itself. A VoIP line is not evidence on its own.

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

https://t.me/guardstates

telegram account IT Worker Fraud THIRD-PARTY REGISTRY live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

Sources

  • lazarus.group/team/dustin-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Dustin Lee / Timothy Morris / Jonathan Willis / 0xguardstate / guardstates” · pulled 2026-09-09

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Dustin Lee as the name of the operator is the cited researcher’s assertion, repeated here as their claim.