Juan Alcantara

Juan Alcantara

alias IT Worker Fraud RESEARCHER POST

First seen 2026-09-23 · last seen 2026-09-23

Source

• Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives the role it presents as Senior Java Full Stack Engineer, and the contact details above. The record adds a number and a Telegram account from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The Telegram account t.me/jeremymichael0709 is already in this corpus from the same May 2025 Narcass3 post that carries jeremymichael0709@gmail.com, the Jeremy Michael address. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.

  haydenmckenzie.com/aliases/juan+alcantara — Hayden McKenzie · under “Juan Alcantara” · pulled 2026-09-23

juanalcantara9012@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-09-23 · last seen 2026-09-23

Source

• Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives the role it presents as Senior Java Full Stack Engineer, and the contact details above. The record adds a number and a Telegram account from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The Telegram account t.me/jeremymichael0709 is already in this corpus from the same May 2025 Narcass3 post that carries jeremymichael0709@gmail.com, the Jeremy Michael address. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.

  haydenmckenzie.com/aliases/juan+alcantara — Hayden McKenzie · under “Juan Alcantara” · pulled 2026-09-23

+14848411212

phone number IT Worker Fraud RESEARCHER POST

First seen 2026-09-23 · last seen 2026-09-23

Line type

phonevalidator.com labels the line LANDLINE while naming Skype Communications as the carrier in the same row. The carrier is an interconnected VoIP provider, which is what the classification here follows.

Looked up 2026-09-30 at phonevalidator.com. This is a lookup of the line itself. A VoIP line is not evidence on its own.

Source

• Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives the role it presents as Senior Java Full Stack Engineer, and the contact details above. The record adds a number and a Telegram account from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The Telegram account t.me/jeremymichael0709 is already in this corpus from the same May 2025 Narcass3 post that carries jeremymichael0709@gmail.com, the Jeremy Michael address. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.

  haydenmckenzie.com/aliases/juan+alcantara — Hayden McKenzie · under “Juan Alcantara” · pulled 2026-09-23

+17738284391

phone number IT Worker Fraud RESEARCHER POST

First seen 2026-09-23 · last seen 2026-09-23

Line type

phonevalidator.com labels the line LANDLINE while naming Skype Communications as the carrier in the same row. The carrier is an interconnected VoIP provider, which is what the classification here follows.

Looked up 2026-09-30 at phonevalidator.com. This is a lookup of the line itself. A VoIP line is not evidence on its own.

Source

• Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives the role it presents as Senior Java Full Stack Engineer, and the contact details above. The record adds a number and a Telegram account from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The Telegram account t.me/jeremymichael0709 is already in this corpus from the same May 2025 Narcass3 post that carries jeremymichael0709@gmail.com, the Jeremy Michael address. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.

  haydenmckenzie.com/aliases/juan+alcantara — Hayden McKenzie · under “Juan Alcantara” · pulled 2026-09-23

https://t.me/jeremymichael0709

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2025-05-12 · last seen 2026-09-23

Sources

• Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives the role it presents as Senior Java Full Stack Engineer, and the contact details above. The record adds a number and a Telegram account from the persona's working files. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The Telegram account t.me/jeremymichael0709 is already in this corpus from the same May 2025 Narcass3 post that carries jeremymichael0709@gmail.com, the Jeremy Michael address. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.

  haydenmckenzie.com/aliases/juan+alcantara — Hayden McKenzie · under “Juan Alcantara” · pulled 2026-09-23

• The first post is a bare list published under the word "btwz" with no operator named. The second post, from the same day, addresses the X accounts jeremymichael79 and Hakeohiratani directly and asks how Pyongyang is, which is the researcher treating both handles as DPRK operators. The two handles are recorded here on that basis. The list itself is still not split between them, because the posts do not say which account holds which identifier, and dividing it would be this site's inference rather than the researcher's. The first post also gives a web3.career handle, which has no indicator type in this repository. The address alexandersimmons824@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address audithunter821@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/Narcass3/status/1921805220478149068 — Narcass3 (@Narcass3) · under “Accounts the researcher addressed to jeremymichael79 and Hakeohiratani” · published 2025-05-12 · pulled 2026-08-30