Kazune Takeda

Also reported as: Greg TakeoRey Santana SocorroJoe Hisaishi

A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.

IT Worker Fraud First reported 2026-09-24

Profiles and evidence

Files published with this identity

Each file is the publisher's copy, mirrored unchanged; its claims are not verified.

LinkedIn accounts

Identifiers reported alongside

21 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Greg Takeo alias —
Joe Hisaishi alias —
Kazune Takeda alias —
Rey Santana Socorro alias —
https://hub.docker.com/u/jwtradera dockerhub account live checked 2026-11-08
https://hub.docker.com/u/kazunetakeda25 dockerhub account live checked 2026-11-08
gregtakeo@gmail.com email address —
jwtradera@outlook.com email address —
kazune.takeda@yahoo.com email address —
zhmolly@proton.me email address —
https://github.com/borrdd34 github profile removed checked 2026-09-30
https://github.com/kazunetakeda25 github profile removed checked 2026-09-02
https://github.com/zhmolly github profile removed checked 2026-08-30
https://gitlab.com/ethfuji gitlab account live checked 2026-11-08
https://gitlab.com/jwtradera gitlab account live checked 2026-11-08
https://gitlab.com/kazunetakeda25 gitlab account live checked 2026-11-08
https://huggingface.co/jwtradera huggingface account live checked 2026-11-08
https://keybase.io/kazunetakeda25 keybase account live checked 2026-11-08
https://t.me/ethfuji telegram account live checked 2026-11-08
https://t.me/kazunetakeda25 telegram account live checked 2026-11-08
https://x.com/kazunetakeda25 x account not checked

Greg Takeo

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09

Joe Hisaishi

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09

Kazune Takeda

alias IT Worker Fraud CURATED

First seen 2026-09-24 · last seen 2026-09-24

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09
  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under ethfuji, a login the index already carries for this persona on another platform. The profile gives a member-since date of 20 December 2019. It displays "D", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
    gitlab.com/ethfuji — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-13
  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under kazunetakeda25, a login the index already carries for this persona on another platform. The profile gives a member-since date of 17 March 2022. It displays the name Kazune Takeda, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
    gitlab.com/kazunetakeda25 — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-13
  • Found on 17 September 2026 by asking Keybase whether an account exists under kazunetakeda25, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 6 October 2022 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    keybase.io/kazunetakeda25 — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-17
  • Found on 17 September 2026 by asking Docker Hub whether an account exists under kazunetakeda25, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 24 March 2022. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/kazunetakeda25 — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-17
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jwtradera -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of John Wilhelmsson. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/jwtradera — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-18
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jwtradera -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of jwt. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/jwtradera — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-18
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jwtradera -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 24 June 2025. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/jwtradera — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-18
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 6 commits signed kazune.takeda@yahoo.com, an address the lazarus.group registry publishes for this persona, to the login borrdd34, which no longer resolves.
    github.com/borrdd34 — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-24

Rey Santana Socorro

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09

https://hub.docker.com/u/jwtradera

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jwtradera -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 24 June 2025. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/jwtradera — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-18

https://hub.docker.com/u/kazunetakeda25

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Docker Hub whether an account exists under kazunetakeda25, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 24 March 2022. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/kazunetakeda25 — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-17

gregtakeo@gmail.com

email address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09

jwtradera@outlook.com

email address IT Worker Fraud MATCHED IN SOURCE

Also listed under Sadao Eiichi Murano, John Wilhelmson — this value’s page names all of them.

First seen 2026-08-30 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09
  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Sadao Eiichi Murano / John Wilhelmsson / zhmolly / zhmoly / dainmoly / 9omo6” · pulled 2026-09-09
  • Nearby text:

    …handles - John Wilhelmsson - JeyHop - jwtradera - zhmoly - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas github.com/davidlucas0402 davidlucas0402@outlook.com -…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “John Wilhelmson / zhmolly” · published 2025-06-19 · pulled 2026-08-30

kazune.takeda@yahoo.com

email address IT Worker Fraud CURATED

First seen 2025-02-18 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 6 commits signed kazune.takeda@yahoo.com, an address the lazarus.group registry publishes for this persona, to the login borrdd34, which no longer resolves.
    github.com/borrdd34 — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-24
  • …![](./naoki-jenson-keisuke-kazune-leon-zhmolly.png) #### Kazune Takeda - mtfuji25 - mtfuji25 - borrdd34 - kazunetakeda25 - kazune.takeda@yahoo.com - t.me/ETHFuji (ID: 5407827675) • ([Messages](./user-5407827675-@ETHFuji.txt)) - github.com/mtfuji25 - npmjs.com/~kazunetakeda25 - AKA…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Kazune Takeda - mtfuji25” · published 2025-06-19 · pulled 2026-08-30
  • Nearby text:

    …seo.shigoto.001@gmail.com[email protected] ivan.dimov.work@gmail.com[email protected] kazune.takeda@yahoo.com[email protected] densyaou@gmail.com[email protected] zombie.eye.dev@gmail.com[email protected]…
    From Vientiane to Vladivostok — Chollima Group · under “Conclusion:” · published 2025-02-18 · pulled 2026-09-12
  • Nearby text:

    …l.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@…
    From Vientiane to Vladivostok — Chollima Group · under “Conclusion:” · published 2025-02-18 · pulled 2026-10-18

zhmolly@proton.me

email address IT Worker Fraud MATCHED IN SOURCE

Also listed under Sadao Eiichi Murano — this value’s page names all of them.

First seen 2026-08-30 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09
  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Sadao Eiichi Murano / John Wilhelmsson / zhmolly / zhmoly / dainmoly / 9omo6” · pulled 2026-09-09
  • Nearby text:

    …List zachxbt/status/1824047425822310580 - David Adachi - davidadachi56@gmail.com - gigazh - dainmoly - davidlucas0402 - jwtradera - zhmolly@proton.me - zhmolly@gigadao.io - github.com/gigazh • [Archive](https://archive.ph/snjV5) - github.com/zhmolly •…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “David Adachi / zhmolly” · published 2025-06-19 · pulled 2026-08-30

https://github.com/borrdd34

github profile IT Worker Fraud CURATED removed checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 6 commits signed kazune.takeda@yahoo.com, an address the lazarus.group registry publishes for this persona, to the login borrdd34, which no longer resolves.
    github.com/borrdd34 — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-24

https://github.com/kazunetakeda25

github profile IT Worker Fraud THIRD-PARTY REGISTRY removed checked 2026-09-02

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09

https://github.com/zhmolly

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-08-30

Listed as zhmolly

Also listed under Sadao Eiichi Murano — this value’s page names all of them.

First seen 2026-08-30 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09
  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Sadao Eiichi Murano / John Wilhelmsson / zhmolly / zhmoly / dainmoly / 9omo6” · pulled 2026-09-09
  • …Adachi / zhmolly - 2025 (jwtradera cluster) - sadaorome - zhmolly - zhmoly - zzmoly - 0xmolly - Moly - github.com/sadaorome - github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - t.me/zzmoly (ID: 1968323567) •…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Sadao Elichi / David Adachi / zhmolly” · published 2025-06-19 · pulled 2026-08-30

https://gitlab.com/ethfuji

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under ethfuji, a login the index already carries for this persona on another platform. The profile gives a member-since date of 20 December 2019. It displays "D", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
    gitlab.com/ethfuji — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-13

https://gitlab.com/jwtradera

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jwtradera -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of John Wilhelmsson. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/jwtradera — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-18

https://gitlab.com/kazunetakeda25

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under kazunetakeda25, a login the index already carries for this persona on another platform. The profile gives a member-since date of 17 March 2022. It displays the name Kazune Takeda, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
    gitlab.com/kazunetakeda25 — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-13

https://huggingface.co/jwtradera

huggingface account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- jwtradera -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of jwt. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/jwtradera — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-18

https://keybase.io/kazunetakeda25

keybase account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Keybase whether an account exists under kazunetakeda25, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 6 October 2022 and no display name but the handle itself. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    keybase.io/kazunetakeda25 — Chollima Hunter · under “Kazune Takeda” · pulled 2026-09-17

https://t.me/ethfuji

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as ethfuji

First seen 2026-09-01 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09
  • …Kazune Takeda - mtfuji25 - mtfuji25 - borrdd34 - kazunetakeda25 - kazune.takeda@yahoo.com - t.me/ETHFuji (ID: 5407827675) • ([Messages](./user-5407827675-@ETHFuji.txt)) - github.com/mtfuji25 - npmjs.com/~kazunetakeda25 - AKA Joe Hisaishi -…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Kazune Takeda - mtfuji25” · published 2025-06-19 · pulled 2026-09-01

https://t.me/kazunetakeda25

telegram account IT Worker Fraud THIRD-PARTY REGISTRY live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09

https://x.com/kazunetakeda25

x account IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kazune Takeda / Greg Takeo / Rey Santana Socorro / Joe Hisaishi” · pulled 2026-09-09

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Kazune Takeda as the name of the operator is the cited researcher’s assertion, repeated here as their claim.