Chollima Hunter

← All personas

Layton Hart

A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.

IT Worker Fraud First reported 2026-09-24

Identifiers attributed to this persona

4 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Layton Hart alias —
laytonhartcool@gmail.com email address —
https://github.com/fly-pig00 github profile removed checked 2026-09-30
+14197460450 phone number —

Layton Hart

alias IT Worker Fraud CURATED

First seen 2026-09-24 · last seen 2026-09-24

Sources

  • Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The number is the same one the table gives against two other names, a link the document does not draw itself.
    docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Layton Hart” · pulled 2026-09-09
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 3 commits signed layton.hart.cool@gmail.com, an address the ZEUS-DEV-919 working document publishes for this persona, to the login Fly-Pig00, which no longer resolves.
    github.com/Fly-Pig00 — Chollima Hunter · under “Layton Hart” · pulled 2026-09-24

laytonhartcool@gmail.com

email address IT Worker Fraud CURATED

Listed as layton.hart.cool@gmail.com

First seen 2025-08-19 · last seen 2026-09-24

Sources

  • Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The number is the same one the table gives against two other names, a link the document does not draw itself.
    docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Layton Hart” · pulled 2026-09-09
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 3 commits signed layton.hart.cool@gmail.com, an address the ZEUS-DEV-919 working document publishes for this persona, to the login Fly-Pig00, which no longer resolves.
    github.com/Fly-Pig00 — Chollima Hunter · under “Layton Hart” · pulled 2026-09-24

  • Nearby text:

    …mareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gmail.com lctruong13@gmail.com leandro.araujo020984@gmail.com lee.smith870327@gmail.com lee.supersenior…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

https://github.com/fly-pig00

github profile IT Worker Fraud CURATED removed checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 3 commits signed layton.hart.cool@gmail.com, an address the ZEUS-DEV-919 working document publishes for this persona, to the login Fly-Pig00, which no longer resolves.
    github.com/Fly-Pig00 — Chollima Hunter · under “Layton Hart” · pulled 2026-09-24

+14197460450

phone number IT Worker Fraud THIRD-PARTY REGISTRY

Also listed under Adam Jones, Yanming Michel — this value’s page names all of them.

First seen unknown · last seen unknown

Line type

Line typeVoIP
CarrierBANDWIDTH.COM
Rate centreKELLEYS ISLAND, OH

Looked up 2026-09-13 at localcallingguide.com and phonevalidator.com. This is a lookup of the line itself. A VoIP line is not evidence on its own.

Sources

  • Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The number is given as a Skype contact rather than a Skype identifier. The number is the same one the table gives against two other names, a link the document does not draw itself.
    docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Yanming Michel” · pulled 2026-09-09
  • Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The number is the same one the table gives against two other names, a link the document does not draw itself.
    docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Layton Hart” · pulled 2026-09-09
  • Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. The Skype number is the same one the table gives against Layton Hart, a link the document does not draw itself.
    docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Adam Jones” · pulled 2026-09-09

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Layton Hart as the name of the operator is the cited researcher’s assertion, repeated here as their claim.