Chollima Hunter

← All personas

John Wilhelmson

Also reported as: zhmolly

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below was filed under the heading “John Wilhelmson / zhmolly” by the report that documented it.

IT Worker Fraud First reported 2026-08-30 · last reported 2026-10-18

LinkedIn accounts

Identifiers reported alongside

5 indicators filed under the same heading, each with its sources.

IndicatorTypeAccount status
davidlucas0402@outlook.com email address —
jwtradera@outlook.com email address —
https://github.com/davidlucas0402 github profile removed checked 2026-08-30
https://github.com/zhmoly github profile removed checked 2026-08-30
https://t.me/elvencoin telegram account not checked

davidlucas0402@outlook.com

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2026-08-30 · last seen 2026-10-18

Source

  • Nearby text:

    …[Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas github.com/davidlucas0402 davidlucas0402@outlook.com - linkedin.com/in/john-wilhelmsson-17b3a0219 - Hello everyone! I'm new to this group.…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “John Wilhelmson / zhmolly” · published 2025-06-19 · pulled 2026-08-30

jwtradera@outlook.com

email address IT Worker Fraud MATCHED IN SOURCE

Also listed under Kazune Takeda, Sadao Eiichi Murano — this value’s page names all of them.

First seen 2026-08-30 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09
  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Sadao Eiichi Murano / John Wilhelmsson / zhmolly / zhmoly / dainmoly / 9omo6” · pulled 2026-09-09

  • Nearby text:

    …handles - John Wilhelmsson - JeyHop - jwtradera - zhmoly - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas github.com/davidlucas0402 davidlucas0402@outlook.com -…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “John Wilhelmson / zhmolly” · published 2025-06-19 · pulled 2026-08-30

https://github.com/davidlucas0402

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-08-30

Listed as davidlucas0402

First seen 2026-08-30 · last seen 2026-10-18

Source

  • Nearby text:

    …github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas github.com/davidlucas0402 davidlucas0402@outlook.com - linkedin.com/in/john-wilhelmsson-17b3a0219 - Hello everyone! I'm new to this group.…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “John Wilhelmson / zhmolly” · published 2025-06-19 · pulled 2026-08-30

https://github.com/zhmoly

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-08-30

Listed as zhmoly

Also listed under Sadao Eiichi Murano — this value’s page names all of them.

First seen 2026-08-30 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Sadao Eiichi Murano / John Wilhelmsson / zhmolly / zhmoly / dainmoly / 9omo6” · pulled 2026-09-09
  • …John Wilhelmson / zhmolly - 2021 - Shows up all over zhmolly handles - John Wilhelmsson - JeyHop - jwtradera - zhmoly - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “John Wilhelmson / zhmolly” · published 2025-06-19 · pulled 2026-08-30

https://t.me/elvencoin

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as elvencoin

First seen 2026-09-01 · last seen 2026-10-18

Source

  • Nearby text:

    …https://www.linkedin.com/in/john-wilhelmsson-17b3a0219/ https://t.me/elvencoin/2139 8/19/2021 #### Naoki Murano - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - Umnal IT worker, Choe Il-kuk…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “John Wilhelmson / zhmolly” · published 2025-06-19 · pulled 2026-09-01

Sources

  • DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “John Wilhelmson / zhmolly” · published 2025-06-19 · pulled 2026-08-30
  • lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09
  • lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Sadao Eiichi Murano / John Wilhelmsson / zhmolly / zhmoly / dainmoly / 9omo6” · pulled 2026-09-09

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. John Wilhelmson is the name an account presented under, not established to be the name of its operator.