Leon Lin
Also reported as: Leon LowdenAbe SinjiroBernard Shibata
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Leon Lin chilling”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Profiles and evidence
Identity document published by the registry under this persona, captioned there as “KYC Leon Lin”. The registry presents it as a document used for this identity. Its name, number and photograph are the document's own and may belong to a real person whose identity was stolen to build the persona.
Photograph published by the registry under this persona, captioned there as “Leon Lin with his friends (Kazune Takeda and Sadao Murano)”. Others in it are shown as published; only the persona is attributed by the registry.
Resume published by the registry under this persona, captioned there as “Part 1 of Leon's Resume”. Every employer, degree and skill in it is the document's own claim.
Resume published by the registry under this persona, captioned there as “Part 2 of Leon's Resume”. Every employer, degree and skill in it is the document's own claim.
Identifiers attributed to this persona
19 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Abe Sinjiro |
alias | |
Bernard Shibata |
alias | |
Leon Lin |
alias | |
Leon Lowden |
alias | |
0xl2@proton.me |
email address | |
abesinjiro7@gmail.com |
email address | |
bernard.shibata@hotmail.com |
email address | |
leonlowden7@gmail.com |
email address | |
leonxdev1@gmail.com |
email address | |
real_striver@outlook.com |
email address | |
https://github.com/0xhiler |
github profile | live |
https://github.com/mmsys34 |
github profile | live |
https://github.com/prodigy205 |
github profile | removed |
https://github.com/shaman236 |
github profile | live |
+66863146268 |
phone number | |
https://t.me/moreleon |
telegram account | live |
0x64d668978ddd6145d4f192eefb03691b75f65096 |
wallet address | |
0x90a8974ed484da8e209e6db7b2f84c1b5be345d0 |
wallet address | |
https://x.com/zeroxjoe |
x account |
Abe Sinjiro
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Bernard Shibata
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Leon Lin
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/shaman236 is account id 37606416, created on 21 March 2018. Its noreply addresses show it was previously named 0xl2, naruto0913 and abe-sinjiro; 0xl2 is on tayvano's list of IT-worker GitHub accounts, which this index already carries, so this is that account under its current name. It signs 94 of the 100 commits GitHub's search returns for it with abe.sinjiro7@gmail.com, and six more commits in its repositories are signed real_striver@outlook.com; lazarus.group gives both addresses for Leon Lin. Its repositories, test-risk among them, are committed with those identities on the day they are created.
github.com/shaman236 — Chollima Hunter
Leon Lowden
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xl2@proton.me
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Lowden (0xl2) - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - 0xl2 - jigoat - zeroxjoe - x.com/zeroxjoe - 0xl2@proton.me - leon.lowden7@gmail.com - github.com/0xl2 • [Archive](https://archive.ph/KolKd) - 0x0c0e8ef4b62a4a2a1b5031911e272362530c1a9a -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
abesinjiro7@gmail.com
email address IT Worker Fraud CURATED
Listed as abe.sinjiro7@gmail.com
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/shaman236 is account id 37606416, created on 21 March 2018. Its noreply addresses show it was previously named 0xl2, naruto0913 and abe-sinjiro; 0xl2 is on tayvano's list of IT-worker GitHub accounts, which this index already carries, so this is that account under its current name. It signs 94 of the 100 commits GitHub's search returns for it with abe.sinjiro7@gmail.com, and six more commits in its repositories are signed real_striver@outlook.com; lazarus.group gives both addresses for Leon Lin. Its repositories, test-risk among them, are committed with those identities on the day they are created.
github.com/shaman236 — Chollima Hunter -
…0x64d668978ddd6145d4f192eefb03691b75f65096 #### Leon - Abe Sinjiro (prodigy205) - 2024 - naruto0913 - prodigy205 - abe.sinjiro7 - abe.sinjiro7@gmail.com - 0x90a8974ed484da8e209e6db7b2f84c1b5be345d0 -  -  --- ##…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
bernard.shibata@hotmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
leonlowden7@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as leon.lowden7@gmail.com
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - 0xl2 - jigoat - zeroxjoe - x.com/zeroxjoe - 0xl2@proton.me - leon.lowden7@gmail.com - github.com/0xl2 • [Archive](https://archive.ph/KolKd) - 0x0c0e8ef4b62a4a2a1b5031911e272362530c1a9a -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
leonxdev1@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…0xfd1b05e51653339c850c8a18c9ac11aed9105f2a #### Leon - Leon Lin (mmsys34, 0xhiler) - 2025 - leonxdev1 - leonxdev1@gmail.com - mmsys - mmsys34 - 0xhiler - moreleon - t.me/moreleon (ID: 7071594535) - 0x64d668978ddd6145d4f192eefb03691b75f65096 #### Leon - Abe…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
real_striver@outlook.com
email address IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/shaman236 is account id 37606416, created on 21 March 2018. Its noreply addresses show it was previously named 0xl2, naruto0913 and abe-sinjiro; 0xl2 is on tayvano's list of IT-worker GitHub accounts, which this index already carries, so this is that account under its current name. It signs 94 of the 100 commits GitHub's search returns for it with abe.sinjiro7@gmail.com, and six more commits in its repositories are signed real_striver@outlook.com; lazarus.group gives both addresses for Leon Lin. Its repositories, test-risk among them, are committed with those identities on the day they are created.
github.com/shaman236 — Chollima Hunter
https://github.com/0xhiler
github profile IT Worker Fraud THIRD-PARTY REGISTRY live
live
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/mmsys34
github profile IT Worker Fraud THIRD-PARTY REGISTRY live
live
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/prodigy205
github profile IT Worker Fraud THIRD-PARTY REGISTRY removed
removed
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/shaman236
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/shaman236 is account id 37606416, created on 21 March 2018. Its noreply addresses show it was previously named 0xl2, naruto0913 and abe-sinjiro; 0xl2 is on tayvano's list of IT-worker GitHub accounts, which this index already carries, so this is that account under its current name. It signs 94 of the 100 commits GitHub's search returns for it with abe.sinjiro7@gmail.com, and six more commits in its repositories are signed real_striver@outlook.com; lazarus.group gives both addresses for Leon Lin. Its repositories, test-risk among them, are committed with those identities on the day they are created.
github.com/shaman236 — Chollima Hunter
+66863146268
phone number IT Worker Fraud THIRD-PARTY REGISTRY
Line type
| Line type | Wireless |
|---|---|
| Carrier | CAT TELECOM |
| Rate centre | THAILAND |
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://t.me/moreleon
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as moreleon
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Leon - Leon Lin (mmsys34, 0xhiler) - 2025 - leonxdev1 - leonxdev1@gmail.com - mmsys - mmsys34 - 0xhiler - moreleon - t.me/moreleon (ID: 7071594535) - 0x64d668978ddd6145d4f192eefb03691b75f65096 #### Leon - Abe Sinjiro (prodigy205) - 2024 - naruto0913 - prodigy205 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0x64d668978ddd6145d4f192eefb03691b75f65096
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x90a8974ed484da8e209e6db7b2f84c1b5be345d0
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://x.com/zeroxjoe
x account IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- lazarus.group/team/leon-lin — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- github.com/shaman236 — Chollima Hunter