Kevin Tan

Kevin Tan

alias IT Worker Fraud CURATED

First seen 2026-09-21 · last seen 2026-09-29

Sources

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/kevin-tan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kevin Tan / diamondyhand / cruzlp#7997” · pulled 2026-09-09

• Read on 21 September 2026 by walking the commit history of every repository on github.com/darkmandev103, an account reached because one of its repositories is a byte-for-byte copy of one held by the account this site files under ZEUS. The account is the registry's own github.com/diamondyhand under a new name: three of its commits carry the noreply address 113045708+diamondyhand@users.noreply.github.com, and 113045708 is darkmandev103's account id, so the handle the lazarus.group registry published for this persona was renamed rather than abandoned, and github.com/diamondyhand now returns nothing. Its own commits are signed masterdevv278@gmail.com 242 times, under the names diamondyhand and masterdevv278, which is the address the registry lists for the persona; the commit metadata ties handle and address to one account first-hand, which the registry entry did not show. The account was created on 7 September 2022, holds 35 repositories, and carries 1,153 followers against 2,239 followed. Nineteen further commits in its repositories are signed yeshealer <yeshealer@gmail.com> and attributed by GitHub to a second account, github.com/yeshealer; that address is on The Raven File's August 2025 list of IT-worker mailboxes, so the second account is recorded here on the strength of the list and the shared repositories, and nothing more is claimed for it. The repository that led here is a poker game: darkmandev103/poker-shuffle-game-react was created on 19 June 2023 with eight commits signed diamondyhand, and accompany1205/pocker-game, on the GitHub account filed under ZEUS, was created four days later holding the same history, its oldest commit signed diamondyhand and dated the day the first repository was made. One account's commits inside another persona's repository is the kind of link this site records between two entries rather than a reason to merge them.

  github.com/darkmandev103 — Chollima Hunter · under “Kevin Tan” · pulled 2026-09-21

• Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (yeshealer) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.

  github.com/yeshealer/yeshealer/blob/302b30a3f7dd33a2538bdaabd34ed61f810a75ea/README.md — Chollima Hunter · under “Kevin Tan” · published 2022-05-15 · pulled 2026-09-29

healer365life@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-29 · last seen 2026-09-29

Source

• Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (yeshealer) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.

  github.com/yeshealer/yeshealer/blob/302b30a3f7dd33a2538bdaabd34ed61f810a75ea/README.md — Chollima Hunter · under “Kevin Tan” · published 2022-05-15 · pulled 2026-09-29

masterdevv278@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-21 · last seen 2026-09-21

Sources

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/kevin-tan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kevin Tan / diamondyhand / cruzlp#7997” · pulled 2026-09-09

• Read on 21 September 2026 by walking the commit history of every repository on github.com/darkmandev103, an account reached because one of its repositories is a byte-for-byte copy of one held by the account this site files under ZEUS. The account is the registry's own github.com/diamondyhand under a new name: three of its commits carry the noreply address 113045708+diamondyhand@users.noreply.github.com, and 113045708 is darkmandev103's account id, so the handle the lazarus.group registry published for this persona was renamed rather than abandoned, and github.com/diamondyhand now returns nothing. Its own commits are signed masterdevv278@gmail.com 242 times, under the names diamondyhand and masterdevv278, which is the address the registry lists for the persona; the commit metadata ties handle and address to one account first-hand, which the registry entry did not show. The account was created on 7 September 2022, holds 35 repositories, and carries 1,153 followers against 2,239 followed. Nineteen further commits in its repositories are signed yeshealer <yeshealer@gmail.com> and attributed by GitHub to a second account, github.com/yeshealer; that address is on The Raven File's August 2025 list of IT-worker mailboxes, so the second account is recorded here on the strength of the list and the shared repositories, and nothing more is claimed for it. The repository that led here is a poker game: darkmandev103/poker-shuffle-game-react was created on 19 June 2023 with eight commits signed diamondyhand, and accompany1205/pocker-game, on the GitHub account filed under ZEUS, was created four days later holding the same history, its oldest commit signed diamondyhand and dated the day the first repository was made. One account's commits inside another persona's repository is the kind of link this site records between two entries rather than a reason to merge them.

  github.com/darkmandev103 — Chollima Hunter · under “Kevin Tan” · pulled 2026-09-21

yeshealer@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-08-19 · last seen 2026-09-21

Sources

• Read on 21 September 2026 by walking the commit history of every repository on github.com/darkmandev103, an account reached because one of its repositories is a byte-for-byte copy of one held by the account this site files under ZEUS. The account is the registry's own github.com/diamondyhand under a new name: three of its commits carry the noreply address 113045708+diamondyhand@users.noreply.github.com, and 113045708 is darkmandev103's account id, so the handle the lazarus.group registry published for this persona was renamed rather than abandoned, and github.com/diamondyhand now returns nothing. Its own commits are signed masterdevv278@gmail.com 242 times, under the names diamondyhand and masterdevv278, which is the address the registry lists for the persona; the commit metadata ties handle and address to one account first-hand, which the registry entry did not show. The account was created on 7 September 2022, holds 35 repositories, and carries 1,153 followers against 2,239 followed. Nineteen further commits in its repositories are signed yeshealer <yeshealer@gmail.com> and attributed by GitHub to a second account, github.com/yeshealer; that address is on The Raven File's August 2025 list of IT-worker mailboxes, so the second account is recorded here on the strength of the list and the shared repositories, and nothing more is claimed for it. The repository that led here is a poker game: darkmandev103/poker-shuffle-game-react was created on 19 June 2023 with eight commits signed diamondyhand, and accompany1205/pocker-game, on the GitHub account filed under ZEUS, was created four days later holding the same history, its oldest commit signed diamondyhand and dated the day the first repository was made. One account's commits inside another persona's repository is the kind of link this site records between two entries rather than a reason to merge them.

  github.com/darkmandev103 — Chollima Hunter · under “Kevin Tan” · pulled 2026-09-21

• Nearby text:

  …pr@gmail.com yanel.remmie@minofangle.org yasmoto1995@gmail.com yeknocokko@gufum.com yellowflash2041@gmail.com yellowstrawberry315@gmail.com yeshealer@gmail.com yinyingchao4@gmail.com yks20000601@gmail.com ymggyymg@sunshine221.anonaddy.com yoltedortu@gufum.com yonikrs216@gmail.com yt1997119@gmail.co…

  Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

https://github.com/darkmandev103

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-21 · last seen 2026-09-21

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Source

• Read on 21 September 2026 by walking the commit history of every repository on github.com/darkmandev103, an account reached because one of its repositories is a byte-for-byte copy of one held by the account this site files under ZEUS. The account is the registry's own github.com/diamondyhand under a new name: three of its commits carry the noreply address 113045708+diamondyhand@users.noreply.github.com, and 113045708 is darkmandev103's account id, so the handle the lazarus.group registry published for this persona was renamed rather than abandoned, and github.com/diamondyhand now returns nothing. Its own commits are signed masterdevv278@gmail.com 242 times, under the names diamondyhand and masterdevv278, which is the address the registry lists for the persona; the commit metadata ties handle and address to one account first-hand, which the registry entry did not show. The account was created on 7 September 2022, holds 35 repositories, and carries 1,153 followers against 2,239 followed. Nineteen further commits in its repositories are signed yeshealer <yeshealer@gmail.com> and attributed by GitHub to a second account, github.com/yeshealer; that address is on The Raven File's August 2025 list of IT-worker mailboxes, so the second account is recorded here on the strength of the list and the shared repositories, and nothing more is claimed for it. The repository that led here is a poker game: darkmandev103/poker-shuffle-game-react was created on 19 June 2023 with eight commits signed diamondyhand, and accompany1205/pocker-game, on the GitHub account filed under ZEUS, was created four days later holding the same history, its oldest commit signed diamondyhand and dated the day the first repository was made. One account's commits inside another persona's repository is the kind of link this site records between two entries rather than a reason to merge them.

  github.com/darkmandev103 — Chollima Hunter · under “Kevin Tan” · pulled 2026-09-21

https://github.com/diamondyhand

github profile IT Worker Fraud THIRD-PARTY REGISTRY removed checked 2026-09-02

First seen unknown · last seen unknown

Source

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/kevin-tan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kevin Tan / diamondyhand / cruzlp#7997” · pulled 2026-09-09

https://github.com/yeshealer

github profile IT Worker Fraud CURATED live checked 2026-09-30

Listed as yeshealer

First seen 2025-08-28 · last seen 2026-10-18

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Sources

• Read on 21 September 2026 by walking the commit history of every repository on github.com/darkmandev103, an account reached because one of its repositories is a byte-for-byte copy of one held by the account this site files under ZEUS. The account is the registry's own github.com/diamondyhand under a new name: three of its commits carry the noreply address 113045708+diamondyhand@users.noreply.github.com, and 113045708 is darkmandev103's account id, so the handle the lazarus.group registry published for this persona was renamed rather than abandoned, and github.com/diamondyhand now returns nothing. Its own commits are signed masterdevv278@gmail.com 242 times, under the names diamondyhand and masterdevv278, which is the address the registry lists for the persona; the commit metadata ties handle and address to one account first-hand, which the registry entry did not show. The account was created on 7 September 2022, holds 35 repositories, and carries 1,153 followers against 2,239 followed. Nineteen further commits in its repositories are signed yeshealer <yeshealer@gmail.com> and attributed by GitHub to a second account, github.com/yeshealer; that address is on The Raven File's August 2025 list of IT-worker mailboxes, so the second account is recorded here on the strength of the list and the shared repositories, and nothing more is claimed for it. The repository that led here is a poker game: darkmandev103/poker-shuffle-game-react was created on 19 June 2023 with eight commits signed diamondyhand, and accompany1205/pocker-game, on the GitHub account filed under ZEUS, was created four days later holding the same history, its oldest commit signed diamondyhand and dated the day the first repository was made. One account's commits inside another persona's repository is the kind of link this site records between two entries rather than a reason to merge them.

  github.com/darkmandev103 — Chollima Hunter · under “Kevin Tan” · pulled 2026-09-21

• Nearby text:

  …hing920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow: suspected https://github.com/super124dev The above-listed GitHub accounts are active (ATTOW) and pose high…

  DPRK IT WORKERS UNVEILED – THE RAVEN FILE — The Raven File · under “GITHUB ACCOUNTS OF DPRK IT WORKERS AKA JASPER SLEET” · published 2025-08-28 · pulled 2026-08-30

• Nearby text:

  …hing920609 https://github.com/univan0928 https://github.com/whitecrow0109 https://github.com/yasmoto1995 https://github.com/yellowflash2041 https://github.com/yeshealer https://github.com/tedzchow https://github.com/super124dev https://github.com/agronkercishta https://github.com/agronkercishta https://gith…

  DPRK GitHub Accounts — The Raven File · published 2025-08-31 · pulled 2026-09-18

+6542982608

phone number IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Line type

A per-number lookup returns no record and marks the number fabricated: invalid Number.

Looked up 2026-09-13 at phonevalidator.com. This is a lookup of the line itself.

Source

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/kevin-tan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kevin Tan / diamondyhand / cruzlp#7997” · pulled 2026-09-09

https://t.me/healer365life

telegram account IT Worker Fraud CURATED live checked 2026-11-08

First seen 2026-09-29 · last seen 2026-09-29

Source

• Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (yeshealer) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.

  github.com/yeshealer/yeshealer/blob/302b30a3f7dd33a2538bdaabd34ed61f810a75ea/README.md — Chollima Hunter · under “Kevin Tan” · published 2022-05-15 · pulled 2026-09-29

0x44dc0a034e096b471a8ef899d71d1d3c8f19890a

wallet address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/kevin-tan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Kevin Tan / diamondyhand / cruzlp#7997” · pulled 2026-09-09