Jason Kwon
Also reported as: 0xMoon0xm00n0xm00n.eth0xm00nethcryptonerd_0xlock
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Jason Kwon. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Photograph published by the registry under this persona, captioned there as “Jason Kwon from the DeSpace team page.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Profiles and evidence
Audience photograph from the report in which the persona was identified.
Identity document published by the registry under this persona, captioned there as “Profile picture of Jason Kwon.”. The registry presents it as a document used for this identity. Its name, number and photograph are the document's own and may belong to a real person whose identity was stolen to build the persona.
Identifiers attributed to this persona
18 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Jason Kwon |
alias | |
https://hub.docker.com/u/0xlock |
dockerhub account | live |
0xm00neth@gmail.com |
email address | |
https://github.com/0xlock |
github profile | live |
https://github.com/0xm00neth |
github profile | removed |
https://github.com/bluesky0309 |
github profile | live |
https://github.com/hightechrun |
github profile | removed |
https://trello.com/u/0xlock |
trello account | |
0x03e6adb71ec39af3d68733f1c3f5e54e6e55b7d2 |
wallet address | |
0x1075e62bfacbb44e31d7a5719e55c7d16fe7d35d |
wallet address | |
0x1e5c29702b770d5519932367129973bd63740392 |
wallet address | |
0x4b94ba1528636a699dab486a217d39bb7ce21d75 |
wallet address | |
0x72c70980acdde7a5c9437050e73e7d07fbf21d25 |
wallet address | |
0x7969b188f7dc6bf80d68f224ac3454dafe6f6d5d |
wallet address | |
0x90cf352ddaf171d41a6ded1d54ceda4005047c93 |
wallet address | |
0xa771609c5c56048f146d2c794c87db946bff27cf |
wallet address | |
0xcdee5da607ad96e966df82dbc3f004ce44859c6f |
wallet address | |
https://x.com/0xm00neth |
x account |
Jason Kwon
alias IT Worker Fraud CURATED
Sources
-
One of two operators the researcher names in a photograph captioned as a row of IT workers. The photograph is not mirrored here: it shows several people the post does not name, and publishing it would put their faces in an index of DPRK indicators on the strength of who they were standing next to.
x.com/narcass3/status/1913816198183305353 — Narcass3 (@Narcass3) -
The gh-fake-analyzer INVESTIGATIONS dataset linked from Ketman's malicious-github-accounts page records that the 0xm00neth account changed its handle to hightechrun and took a new alias, Roy Hensley, with the GitHub account bluesky0309, whose repositories that page shows copied with the originals' merge messages.
github.com/shortdoom/gh-fake-analyzer/tree/db-updates/profiles/INVESTIGATIONS — bbsz (@blackbigswan) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 17 September 2026 by asking Docker Hub whether an account exists under 0xlock, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 6 February 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/0xlock — Chollima Hunter -
Found on 18 September 2026 by putting 0xlock, the GitHub login the index already holds for this persona, to Maigret's username search and then asking Trello's public member endpoint, which answers 404 for a name that does not exist. The member record states the display name Lock and no bio; a display name that restates the handle stays in the note. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
trello.com/u/0xlock — Chollima Hunter
https://hub.docker.com/u/0xlock
dockerhub account IT Worker Fraud CURATED live
live
Source
-
Found on 17 September 2026 by asking Docker Hub whether an account exists under 0xlock, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 6 February 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/0xlock — Chollima Hunter
0xm00neth@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under Jason Lee — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…DeSpace, Beanstalk, Blueberry, Spice Finance, - 0xMoon - 0xm00n - 0xm00n.eth - 0xm00neth - cryptonerd_ - 0xm00neth@gmail.com - 0xlock - github.com/0xm00neth • [Archive](https://archive.ph/WIu3i) - github.com/0xlock • [Archive](https://archive.ph/J347l) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…denisleedragon@outlook.com[email protected] ivandimov921016@outlook.com[email protected] ZachXBT Supplied: 0xm00neth@gmail.com[email protected] naokimurano@outlook.com[email protected] joshupgig@gmail.com[email protected] smart.solidity@gmail.com[email protected]…
From Vientiane to Vladivostok — Chollima Group -
…Supplied: 0xm00neth@gmail.com naokimurano@outlook.com joshupgig@gmail.com smart.solidity@gmail.com Crypto Wallets: Note: These are low confidence.…
From Vientiane to Vladivostok — Chollima Group
https://github.com/0xlock
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as 0xlock
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…0xm00n.eth - 0xm00neth - cryptonerd_ - 0xm00neth@gmail.com - 0xlock - github.com/0xm00neth • [Archive](https://archive.ph/WIu3i) - github.com/0xlock • [Archive](https://archive.ph/J347l) - x.com/0xm00neth - https://cryptototem.com/despace-des/ -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/0xm00neth
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as 0xm00neth
Also listed under Jason Lee — this value’s page names all of them.
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Beanstalk, Blueberry, Spice Finance, - 0xMoon - 0xm00n - 0xm00n.eth - 0xm00neth - cryptonerd_ - 0xm00neth@gmail.com - 0xlock - github.com/0xm00neth • [Archive](https://archive.ph/WIu3i) - github.com/0xlock • [Archive](https://archive.ph/J347l) - x.com/0xm00neth -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/bluesky0309
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The gh-fake-analyzer INVESTIGATIONS dataset linked from Ketman's malicious-github-accounts page records that the 0xm00neth account changed its handle to hightechrun and took a new alias, Roy Hensley, with the GitHub account bluesky0309, whose repositories that page shows copied with the originals' merge messages.
github.com/shortdoom/gh-fake-analyzer/tree/db-updates/profiles/INVESTIGATIONS — bbsz (@blackbigswan)
https://github.com/hightechrun
github profile IT Worker Fraud RESEARCHER POST removed
removed
Source
-
The gh-fake-analyzer INVESTIGATIONS dataset linked from Ketman's malicious-github-accounts page records that the 0xm00neth account changed its handle to hightechrun and took a new alias, Roy Hensley, with the GitHub account bluesky0309, whose repositories that page shows copied with the originals' merge messages.
github.com/shortdoom/gh-fake-analyzer/tree/db-updates/profiles/INVESTIGATIONS — bbsz (@blackbigswan)
https://trello.com/u/0xlock
trello account IT Worker Fraud CURATED
Source
-
Found on 18 September 2026 by putting 0xlock, the GitHub login the index already holds for this persona, to Maigret's username search and then asking Trello's public member endpoint, which answers 404 for a name that does not exist. The member record states the display name Lock and no bio; a display name that restates the handle stays in the note. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
trello.com/u/0xlock — Chollima Hunter
0x03e6adb71ec39af3d68733f1c3f5e54e6e55b7d2
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x1075e62bfacbb44e31d7a5719e55c7d16fe7d35d
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x1e5c29702b770d5519932367129973bd63740392
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x4b94ba1528636a699dab486a217d39bb7ce21d75
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x72c70980acdde7a5c9437050e73e7d07fbf21d25
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x7969b188f7dc6bf80d68f224ac3454dafe6f6d5d
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x90cf352ddaf171d41a6ded1d54ceda4005047c93
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xa771609c5c56048f146d2c794c87db946bff27cf
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xcdee5da607ad96e966df82dbc3f004ce44859c6f
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://x.com/0xm00neth
x account IT Worker Fraud THIRD-PARTY REGISTRY
Also listed under Jason Lee — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- From Vientiane to Vladivostok — Chollima Group
- x.com/narcass3/status/1913816198183305353 — Narcass3 (@Narcass3)
- github.com/shortdoom/gh-fake-analyzer/tree/db-updates/profiles/INVESTIGATIONS — bbsz (@blackbigswan)
- lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- hub.docker.com/u/0xlock — Chollima Hunter
- trello.com/u/0xlock — Chollima Hunter