Jannik Villostas
Also reported as: 0xtomoonmrcontract17877Henry Amingonzalodecruzshoyanovaccode365
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's.
Profiles and evidence
Avatar published by the registry under this persona, captioned there as “Jannik Villostas avatar.”. It is the picture the identity presented, not a likeness of anyone.
Identifiers attributed to this persona
9 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
gonzalodecruz |
alias | |
Henry Amin |
alias | |
Jannik Villostas |
alias | |
shoyano |
alias | |
melonman913@gmail.com |
email address | |
https://github.com/0xtomoon |
github profile | live |
https://t.me/janbuidl |
telegram account | live |
0x1febc069606abfba5d021ed3768cb5d90c9407d5 |
wallet address | |
https://x.com/mrcontract17877 |
x account |
gonzalodecruz
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Henry Amin
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Jannik Villostas
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
shoyano
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
melonman913@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under Janul Azwan, Chai Somsri — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/chai-somsri — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…0x94A8518B76A3c45F5387B521695024379d43d715 -  #### Jannik Villostas - 2025 - 0xtomoon - mrcontract17877 - melonman913@gmail.com - github.com/0xtomoon • [Archive](https://web.archive.org/web/20250516070156/https://github.com/0xtomoon) - x.com/mrcontract17877 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/0xtomoon
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as 0xtomoon
Also listed under Janul Azwan — this value’s page names all of them.
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
… #### Jannik Villostas - 2025 - 0xtomoon - mrcontract17877 - melonman913@gmail.com - github.com/0xtomoon • [Archive](https://web.archive.org/web/20250516070156/https://github.com/0xtomoon) - x.com/mrcontract17877 - t.me/janbuidl…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://t.me/janbuidl
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as janbuidl
Also listed under Janul Azwan — this value’s page names all of them.
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…linkedin.com/in/janul-azwan-7b1612361/ - immunefi.com/profile/ethprotector/ - t.me/janbuidl (ID:7245484067) • ([Messages](./user-7245484067-@janbuidl-@mrcontract17877-@0xtomoon-Jannik-Villostas.txt)) #### Peter Wang - 2025 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0x1febc069606abfba5d021ed3768cb5d90c9407d5
wallet address IT Worker Fraud MATCHED IN SOURCE
Listed as Ethereum
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…- Bunzz's DPRK IT Worker (2025) - 0xcdd3429318a51b0094db7a172ea356cfd2ae06b3 - Bunzz's DPRK IT Worker (2025) - 0x1febc069606abfba5d021ed3768cb5d90c9407d5 - Jannik Villostas / 0xtomoon / janbuidls - 0x6f24bebcbfa23b7ee32894355ecbdbc24b520d9e - Jannik Villostas / 0xtomoon / janbuidls -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://x.com/mrcontract17877
x account IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- lazarus.group/team/chai-somsri — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group)