Eric Andrade
Also reported as: Josh ThomasgsofterGuru2921Adelin IonutGuruSoftwareMastergurusoft13
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Eric Andrade headshot”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Second profile picture of Eric Andrade.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Identifiers attributed to this persona
20 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Adelin Ionut |
alias | |
Eric Andrade |
alias | |
GuruSoftwareMaster |
alias | |
Josh Thomas |
alias | |
https://hub.docker.com/u/gsofter |
dockerhub account | live |
https://hub.docker.com/u/guru2921 |
dockerhub account | live |
eric@gsofter.com |
email address | |
guru.softwaremaster@mail.ru |
email address | |
ivanromanov1771@gmail.com |
email address | |
real.kingstar@outlook.com |
email address | |
gsofter.eth |
ens name | |
https://github.com/gsofter |
github profile | removed |
https://github.com/guru2921 |
github profile | removed |
https://github.com/poodaydreamer |
github profile | live |
https://gitlab.com/gsofter |
gitlab account | live |
https://gitlab.com/guru2921 |
gitlab account | live |
https://keybase.io/ggsofter |
keybase account | live |
0xe2becede47e8cba800b42323117a15399a6b5334 |
wallet address | |
0xfff50b1b9154b0631591dab746c5fc8f41dc44bd |
wallet address | |
https://x.com/ggsofter |
x account |
Adelin Ionut
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. Two GitLab accounts exist under two of the logins attributed to this operator, and each presents a different name again: gsofter is "Adelin Ionut", a member since 17 August 2021, and guru2921 is "Guru Softwaremaster", a member since 27 February 2020. Neither carries a bio, a location or a link. Two accounts under this operator’s handles presenting two further unrelated names is the pattern this dataset shows throughout, and it is why a name on any of these pages is treated as what the account presents rather than as an identification. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/gsofter — Chollima Hunter
Eric Andrade
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. Two GitLab accounts exist under two of the logins attributed to this operator, and each presents a different name again: gsofter is "Adelin Ionut", a member since 17 August 2021, and guru2921 is "Guru Softwaremaster", a member since 27 February 2020. Neither carries a bio, a location or a link. Two accounts under this operator’s handles presenting two further unrelated names is the pattern this dataset shows throughout, and it is why a name on any of these pages is treated as what the account presents rather than as an identification. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/gsofter — Chollima Hunter -
Found on 17 September 2026 by asking Keybase whether an account exists under ggsofter, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 20 February 2021 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
keybase.io/ggsofter — Chollima Hunter -
Found on 17 September 2026 by asking Docker Hub whether an account exists under gsofter, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 30 July 2023. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/gsofter — Chollima Hunter -
Found on 17 September 2026 by asking Docker Hub whether an account exists under guru2921, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 3 September 2019. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/guru2921 — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/poodaydreamer is account id 49583931, created on 13 April 2019, display name poodler, with 149 public repositories. Its commits carry noreply addresses under gsofter, guru2921 and gurusoft13, so it is the account lazarus.group lists as both github.com/gsofter and github.com/guru2921, renamed; tayvano lists gsofter. Neither handle now resolves. Its repositories hold 97 commits signed real.kingstar@outlook.com, an address the registry gives for Eric Andrade, under the author name gsofter.
github.com/poodaydreamer — Chollima Hunter
GuruSoftwareMaster
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Josh Thomas
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://hub.docker.com/u/gsofter
dockerhub account IT Worker Fraud CURATED live
live
Source
-
Found on 17 September 2026 by asking Docker Hub whether an account exists under gsofter, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 30 July 2023. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/gsofter — Chollima Hunter
https://hub.docker.com/u/guru2921
dockerhub account IT Worker Fraud CURATED live
live
Source
-
Found on 17 September 2026 by asking Docker Hub whether an account exists under guru2921, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 3 September 2019. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/guru2921 — Chollima Hunter
eric@gsofter.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
guru.softwaremaster@mail.ru
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
ivanromanov1771@gmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
real.kingstar@outlook.com
email address IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/poodaydreamer is account id 49583931, created on 13 April 2019, display name poodler, with 149 public repositories. Its commits carry noreply addresses under gsofter, guru2921 and gurusoft13, so it is the account lazarus.group lists as both github.com/gsofter and github.com/guru2921, renamed; tayvano lists gsofter. Neither handle now resolves. Its repositories hold 97 commits signed real.kingstar@outlook.com, an address the registry gives for Eric Andrade, under the author name gsofter.
github.com/poodaydreamer — Chollima Hunter
gsofter.eth
ens name IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/gsofter
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as gsofter
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
… #### Eric Andrade aka Josh Thomas - gsofter.eth - github.com/gsofter • [Archive](https://archive.ph/Z4SBi) - x.com/ggsofter - 0xfff50b1b9154b0631591dab746c5fc8f41dc44bd -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/guru2921
github profile IT Worker Fraud THIRD-PARTY REGISTRY removed
removed
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/poodaydreamer
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/poodaydreamer is account id 49583931, created on 13 April 2019, display name poodler, with 149 public repositories. Its commits carry noreply addresses under gsofter, guru2921 and gurusoft13, so it is the account lazarus.group lists as both github.com/gsofter and github.com/guru2921, renamed; tayvano lists gsofter. Neither handle now resolves. Its repositories hold 97 commits signed real.kingstar@outlook.com, an address the registry gives for Eric Andrade, under the author name gsofter.
github.com/poodaydreamer — Chollima Hunter
https://gitlab.com/gsofter
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. Two GitLab accounts exist under two of the logins attributed to this operator, and each presents a different name again: gsofter is "Adelin Ionut", a member since 17 August 2021, and guru2921 is "Guru Softwaremaster", a member since 27 February 2020. Neither carries a bio, a location or a link. Two accounts under this operator’s handles presenting two further unrelated names is the pattern this dataset shows throughout, and it is why a name on any of these pages is treated as what the account presents rather than as an identification. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/gsofter — Chollima Hunter
https://gitlab.com/guru2921
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. Two GitLab accounts exist under two of the logins attributed to this operator, and each presents a different name again: gsofter is "Adelin Ionut", a member since 17 August 2021, and guru2921 is "Guru Softwaremaster", a member since 27 February 2020. Neither carries a bio, a location or a link. Two accounts under this operator’s handles presenting two further unrelated names is the pattern this dataset shows throughout, and it is why a name on any of these pages is treated as what the account presents rather than as an identification. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/guru2921 — Chollima Hunter
https://keybase.io/ggsofter
keybase account IT Worker Fraud CURATED live
live
Source
-
Found on 17 September 2026 by asking Keybase whether an account exists under ggsofter, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 20 February 2021 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
keybase.io/ggsofter — Chollima Hunter
0xe2becede47e8cba800b42323117a15399a6b5334
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xfff50b1b9154b0631591dab746c5fc8f41dc44bd
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://x.com/ggsofter
x account IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- lazarus.group/team/eric-andrade — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- gitlab.com/gsofter — Chollima Hunter
- gitlab.com/guru2921 — Chollima Hunter
- keybase.io/ggsofter — Chollima Hunter
- hub.docker.com/u/gsofter — Chollima Hunter
- hub.docker.com/u/guru2921 — Chollima Hunter
- github.com/poodaydreamer — Chollima Hunter