Janul Azwan
Also reported as: 0xtomoonethprotector
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Janul Azwan 1.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Profiles and evidence
Avatar published by the registry under this persona, captioned there as “Janul Azwan avatar.”. It is the picture the identity presented, not a likeness of anyone.
LinkedIn accounts
janul-azwan-7b1612361
removed
linkedin profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as janul-azwan-7b1612361
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…melonman913@gmail.com - github.com/0xtomoon • [Archive](https://web.archive.org/web/20250516070156/https://github.com/0xtomoon) - linkedin.com/in/janul-azwan-7b1612361/ - immunefi.com/profile/ethprotector/ - t.me/janbuidl (ID:7245484067) •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Identifiers reported alongside
6 indicators filed under the same heading, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
ethprotector |
alias | |
Janul Azwan |
alias | |
melonman913@gmail.com |
email address | |
https://github.com/0xtomoon |
github profile | live |
immunefi.com/profile/ethprotector |
personal site | |
https://t.me/janbuidl |
telegram account |
ethprotector
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Janul Azwan
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Read on 12 September 2026 from the page cited. ethprotector is one of the names the reporting already files this operator under, and the URL appears inside a researcher’s note this site already quotes, but it had never been recorded as an indicator of its own. The profile is a bug-bounty account on Immunefi: a member since 8 April 2024, ranked 520th all time, total earnings of $13,697, one bug-bounty report rated high, and two audit-competition reports. A DPRK IT-worker persona paid through a whitehat bounty platform is being paid by the projects it reports bugs to, under a name and a payment route of its own choosing, which is a different funding path from the salaried contract work this dataset is mostly about. Nothing here establishes that the reports were not genuine security work.
immunefi.com/profile/ethprotector — Chollima Hunter
melonman913@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under Chai Somsri, Jannik Villostas — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/chai-somsri — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…0x94A8518B76A3c45F5387B521695024379d43d715 -  #### Jannik Villostas - 2025 - 0xtomoon - mrcontract17877 - melonman913@gmail.com - github.com/0xtomoon • [Archive](https://web.archive.org/web/20250516070156/https://github.com/0xtomoon) - x.com/mrcontract17877 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/0xtomoon
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as 0xtomoon
Also listed under Jannik Villostas — this value’s page names all of them.
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
… #### Jannik Villostas - 2025 - 0xtomoon - mrcontract17877 - melonman913@gmail.com - github.com/0xtomoon • [Archive](https://web.archive.org/web/20250516070156/https://github.com/0xtomoon) - x.com/mrcontract17877 - t.me/janbuidl…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
immunefi.com/profile/ethprotector
personal site IT Worker Fraud CURATED
Registration
| Registered | 2020-09-13 |
|---|---|
| Registrar | Squarespace Domains II LLC |
| Expires | 2027-09-13 |
| Last changed | 2026-08-30 |
| Status | client delete prohibited, client transfer prohibited |
Source
-
Read on 12 September 2026 from the page cited. ethprotector is one of the names the reporting already files this operator under, and the URL appears inside a researcher’s note this site already quotes, but it had never been recorded as an indicator of its own. The profile is a bug-bounty account on Immunefi: a member since 8 April 2024, ranked 520th all time, total earnings of $13,697, one bug-bounty report rated high, and two audit-competition reports. A DPRK IT-worker persona paid through a whitehat bounty platform is being paid by the projects it reports bugs to, under a name and a payment route of its own choosing, which is a different funding path from the salaried contract work this dataset is mostly about. Nothing here establishes that the reports were not genuine security work.
immunefi.com/profile/ethprotector — Chollima Hunter
https://t.me/janbuidl
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as janbuidl
Also listed under Jannik Villostas — this value’s page names all of them.
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…linkedin.com/in/janul-azwan-7b1612361/ - immunefi.com/profile/ethprotector/ - t.me/janbuidl (ID:7245484067) • ([Messages](./user-7245484067-@janbuidl-@mrcontract17877-@0xtomoon-Jannik-Villostas.txt)) #### Peter Wang - 2025 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/chai-somsri — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- immunefi.com/profile/ethprotector — Chollima Hunter