Jason Lee
Also reported as: punk1004jasonlee96270xJason
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Jason Lee related to Party Doge project.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Jason Lee related to Party Doge project.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Identifiers attributed to this persona
7 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Jason Lee |
alias | |
https://dev.to/0xm00neth |
devto account | live |
0xm00neth@gmail.com |
email address | |
jasonlee9627@gmail.com |
email address | |
https://github.com/0xm00neth |
github profile | removed |
https://gitlab.com/0xm00neth |
gitlab account | live |
https://x.com/0xm00neth |
x account |
Jason Lee
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. Two accounts under the login this operator is already indexed under: a GitLab account, a member since 12 July 2021, displaying "0xm00n"; and a DEV Community account that joined on 22 June 2022, displays "0x Moon", links the GitHub account of the same name and has published nothing. Its entire biography is the string "404 bio not found" — the same placeholder the DEV account of an unrelated persona in this index, bestsilvertiger, also carries, which is a shared habit rather than a shared account.
gitlab.com/0xm00neth — Chollima Hunter
https://dev.to/0xm00neth
devto account IT Worker Fraud CURATED live
live
Source
-
Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. Two accounts under the login this operator is already indexed under: a GitLab account, a member since 12 July 2021, displaying "0xm00n"; and a DEV Community account that joined on 22 June 2022, displays "0x Moon", links the GitHub account of the same name and has published nothing. Its entire biography is the string "404 bio not found" — the same placeholder the DEV account of an unrelated persona in this index, bestsilvertiger, also carries, which is a shared habit rather than a shared account.
dev.to/0xm00neth — Chollima Hunter
0xm00neth@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under Jason Kwon — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…DeSpace, Beanstalk, Blueberry, Spice Finance, - 0xMoon - 0xm00n - 0xm00n.eth - 0xm00neth - cryptonerd_ - 0xm00neth@gmail.com - 0xlock - github.com/0xm00neth • [Archive](https://archive.ph/WIu3i) - github.com/0xlock • [Archive](https://archive.ph/J347l) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…denisleedragon@outlook.com[email protected] ivandimov921016@outlook.com[email protected] ZachXBT Supplied: 0xm00neth@gmail.com[email protected] naokimurano@outlook.com[email protected] joshupgig@gmail.com[email protected] smart.solidity@gmail.com[email protected]…
From Vientiane to Vladivostok — Chollima Group -
…Supplied: 0xm00neth@gmail.com naokimurano@outlook.com joshupgig@gmail.com smart.solidity@gmail.com Crypto Wallets: Note: These are low confidence.…
From Vientiane to Vladivostok — Chollima Group
jasonlee9627@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Jason Lee - Kira Network, Metadallion, Party Doge, Yam Finance - jasonlee9627 - 0xJason (Discord) - Punk1004.eth - jasonlee9627@gmail.com - github.com/pudgePenguin - 0xd71cfaa9051e88fa282ae78c165d1788fab0f2cb (punk1004.eth) - 0x099336af1b84fe02f1fe695820024f46cb27b1af -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
Per DTEX's own advisory text: these IOCs are NOT indicative of a confirmed North-Korea-attributed hack — they may have associations with IT-worker operations and require further investigation if observed in your environment. Any connection to actual persons may be deliberate (an operator using a real person's identity) or incidental, and the actual owner of an email account listed here may be unaware their address is associated with this IOC list. Do not treat presence on this list as proof of wrongdoing by the account holder.
i3 Threat Advisory: Identifying North Korean IT Workers: Key Threat Indicators — DTEX Systems
https://github.com/0xm00neth
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as 0xm00neth
Also listed under Jason Kwon — this value’s page names all of them.
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Beanstalk, Blueberry, Spice Finance, - 0xMoon - 0xm00n - 0xm00n.eth - 0xm00neth - cryptonerd_ - 0xm00neth@gmail.com - 0xlock - github.com/0xm00neth • [Archive](https://archive.ph/WIu3i) - github.com/0xlock • [Archive](https://archive.ph/J347l) - x.com/0xm00neth -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://gitlab.com/0xm00neth
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. Two accounts under the login this operator is already indexed under: a GitLab account, a member since 12 July 2021, displaying "0xm00n"; and a DEV Community account that joined on 22 June 2022, displays "0x Moon", links the GitHub account of the same name and has published nothing. Its entire biography is the string "404 bio not found" — the same placeholder the DEV account of an unrelated persona in this index, bestsilvertiger, also carries, which is a shared habit rather than a shared account.
gitlab.com/0xm00neth — Chollima Hunter
https://x.com/0xm00neth
x account IT Worker Fraud THIRD-PARTY REGISTRY
Also listed under Jason Kwon — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- From Vientiane to Vladivostok — Chollima Group
- lazarus.group/team/jason-kwon — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/jason-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- gitlab.com/0xm00neth — Chollima Hunter
- dev.to/0xm00neth — Chollima Hunter