Lucas Wong
Also reported as: cox1118superlwclxLucasWongCc__x__
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Profile picture of Lucas Wong.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Identifiers attributed to this persona
10 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Lucas Wong |
alias | |
lucaswong1118@gmail.com |
email address | |
wm111898@gmail.com |
email address | |
https://github.com/codeprom |
github profile | live |
https://github.com/lucaswongc |
github profile | live |
https://github.com/superlwclx |
github profile | removed |
https://gitlab.com/lucaswongc |
gitlab account | live |
https://t.me/cox1118 |
telegram account | live |
0x94a8518b76a3c45f5387b521695024379d43d715 |
wallet address | |
0xee52717e6da13499a3c4ba803e4d952cf052704e |
wallet address |
Lucas Wong
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. A GitLab account under the login lucaswongc, a member since 19 August 2022, whose display name is Lucas Wong — the name the reporting already gives this operator. No bio, location or links.
gitlab.com/lucaswongc — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/codeprom is account id 101302451, created on 10 March 2022, with 92 public repositories and 152 followers. Its commits carry 101302451+lucaswongc@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/lucaswongc, renamed; that handle now returns not found. It signs 59 of the 100 commits GitHub's search returns for it with wm111898@gmail.com, an address the registry gives for Lucas Wong.
github.com/codeprom — Chollima Hunter
lucaswong1118@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as lucas.wong.1118@gmail.com
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…t.me/cox1118 (ID: 5034927805) • ([Messages](./user-5034927805-@cox1118-Lucas-Wong.txt)) - lucas.wong.1118@gmail.com - wm111898@gmail.com - Discord: c__x__ - lucasw.net - 0xee52717e6dA13499a3C4ba803e4D952CF052704E -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
wm111898@gmail.com
email address IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/codeprom is account id 101302451, created on 10 March 2022, with 92 public repositories and 152 followers. Its commits carry 101302451+lucaswongc@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/lucaswongc, renamed; that handle now returns not found. It signs 59 of the 100 commits GitHub's search returns for it with wm111898@gmail.com, an address the registry gives for Lucas Wong.
github.com/codeprom — Chollima Hunter -
…t.me/cox1118 (ID: 5034927805) • ([Messages](./user-5034927805-@cox1118-Lucas-Wong.txt)) - lucas.wong.1118@gmail.com - wm111898@gmail.com - Discord: c__x__ - lucasw.net - 0xee52717e6dA13499a3C4ba803e4D952CF052704E - 0x94A8518B76A3c45F5387B521695024379d43d715 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/codeprom
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/codeprom is account id 101302451, created on 10 March 2022, with 92 public repositories and 152 followers. Its commits carry 101302451+lucaswongc@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/lucaswongc, renamed; that handle now returns not found. It signs 59 of the 100 commits GitHub's search returns for it with wm111898@gmail.com, an address the registry gives for Lucas Wong.
github.com/codeprom — Chollima Hunter
https://github.com/lucaswongc
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as lucaswongc
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…BaHNYFQYsBKX541kjEB9sgoHCc7NQdwc16S5ZE9bmYYv #### Lucas Wong - 2025 - cox1118 - superlwclx - LucasWongC - github.com/superlwclx - github.com/LucasWongC • [Archive](https://web.archive.org/web/20250108192702/https://github.com/LucasWongC) - t.me/cox1118 (ID: 5034927805) •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/superlwclx
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as superlwclx
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…- BaHNYFQYsBKX541kjEB9sgoHCc7NQdwc16S5ZE9bmYYv #### Lucas Wong - 2025 - cox1118 - superlwclx - LucasWongC - github.com/superlwclx - github.com/LucasWongC • [Archive](https://web.archive.org/web/20250108192702/https://github.com/LucasWongC) - t.me/cox1118 (ID:…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://gitlab.com/lucaswongc
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. A GitLab account under the login lucaswongc, a member since 19 August 2022, whose display name is Lucas Wong — the name the reporting already gives this operator. No bio, location or links.
gitlab.com/lucaswongc — Chollima Hunter
https://t.me/cox1118
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as cox1118
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…github.com/superlwclx - github.com/LucasWongC • [Archive](https://web.archive.org/web/20250108192702/https://github.com/LucasWongC) - t.me/cox1118 (ID: 5034927805) • ([Messages](./user-5034927805-@cox1118-Lucas-Wong.txt)) - lucas.wong.1118@gmail.com - wm111898@gmail.com - Discord:…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0x94a8518b76a3c45f5387b521695024379d43d715
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xee52717e6da13499a3c4ba803e4d952cf052704e
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- lazarus.group/team/lucas-wong — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- gitlab.com/lucaswongc — Chollima Hunter
- github.com/codeprom — Chollima Hunter