Marcin Iwanski

Brent Jeremy

alias IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- brentjeremynel -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Brent Jeremy. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/brentjeremynel — Chollima Hunter · under “Marcin Iwanski / Brent Jeremy” · pulled 2026-09-18

Dragan Leonidov

alias IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 17 June 2022 and a display name of Dragan Leonidov. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  dev.to/ernestpapyan — Chollima Hunter · under “Marcin Iwanski / Dragan Leonidov” · pulled 2026-09-18

Ernest Papyan

alias IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 June 2024 and a display name of Ernest Papyan. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  hub.docker.com/u/ernestpapyan — Chollima Hunter · under “Marcin Iwanski / Ernest Papyan” · pulled 2026-09-18

Jan Radu

alias IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- onetouch0525 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Jan Radu. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/onetouch0525 — Chollima Hunter · under “Marcin Iwanski / Jan Radu” · pulled 2026-09-18

Marcin Iwanski

alias IT Worker Fraud CURATED

First seen unknown · last seen unknown

Sources

• Read on 13 September 2026 from the two pages cited. The Medium account @smartdev0205 writes under the display name Promise-Is-Law, which is the handle the reporting files this operator under, and the same string is the handle of the Telegram account t.me/smartdev0205 already recorded here. It holds three stories, the earliest dated 5 December 2023 and one of them carried by the Coinmonks publication, and shows 36 followers against 13 accounts followed. Its about page states one website, brent-jeremy.github.io. That hostname is a GitHub Pages user site, which GitHub serves only from the account of the same name, so the profile is publishing github.com/brent-jeremy — an account the reporting already lists under this persona beside brentjeremynel@gmail.com and two LinkedIn accounts in the same name. Both the Pages site and the GitHub account now return 404. Because the account has been deleted the hostname is unclaimed and could be registered by an unrelated party later; what the about page fixes is the account it pointed to when it was written.

  medium.com/@smartdev0205 — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-13

• Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under pedrodiaz417, a login the index already carries for this persona on another platform. The profile gives a member-since date of 2 May 2022. It displays "PedroDiaz417", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.

  gitlab.com/PedroDiaz417 — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-13

• Found on 17 September 2026 by asking Hugging Face whether an account exists under smartdev0205, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of SmartDev. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  huggingface.co/smartdev0205 — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-17

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- brentjeremynel -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Brent Jeremy. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/brentjeremynel — Chollima Hunter · under “Marcin Iwanski / Brent Jeremy” · pulled 2026-09-18

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- donatelo212dunccine -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Dream High. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/donatelo212dunccine — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-18

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/ernestpapyan — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-18

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 17 June 2022 and a display name of Dragan Leonidov. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  dev.to/ernestpapyan — Chollima Hunter · under “Marcin Iwanski / Dragan Leonidov” · pulled 2026-09-18

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 June 2024 and a display name of Ernest Papyan. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  hub.docker.com/u/ernestpapyan — Chollima Hunter · under “Marcin Iwanski / Ernest Papyan” · pulled 2026-09-18

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- onetouch0525 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Jan Radu. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/onetouch0525 — Chollima Hunter · under “Marcin Iwanski / Jan Radu” · pulled 2026-09-18

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- smartdevpro001 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Smart Dev. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/smartdevpro001 — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-18

https://dev.to/ernestpapyan

devto account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 17 June 2022 and a display name of Dragan Leonidov. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  dev.to/ernestpapyan — Chollima Hunter · under “Marcin Iwanski / Dragan Leonidov” · pulled 2026-09-18

https://hub.docker.com/u/ernestpapyan

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 June 2024 and a display name of Ernest Papyan. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  hub.docker.com/u/ernestpapyan — Chollima Hunter · under “Marcin Iwanski / Ernest Papyan” · pulled 2026-09-18

88yurchak@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …talentdev610@gmail.com[email protected] leonpower123@outlook.com[email protected] oskardev0112@gmail.com[email protected] 88yurchak@gmail.com[email protected]…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-09-11

• Nearby text:

  …apyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/sq…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

brentjeremynel@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-05-14 · last seen 2026-10-18

Sources

• Nearby text:

  …Iwanski) - Brent Jeremy - Marcin Iwanski - Liguo Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …smartdevpro001@gmail.com[email protected] brentjeremynel@gmail.com[email protected] onetouch0525@gmail.com[email protected] kevinlee2821@gmail.com[email protected]…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-09-11

• Nearby text:

  …(Marcin Iwanski): --------------------------------------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gm…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

• Per DTEX's own advisory text: these IOCs are NOT indicative of a confirmed North-Korea-attributed hack — they may have associations with IT-worker operations and require further investigation if observed in your environment. Any connection to actual persons may be deliberate (an operator using a real person's identity) or incidental, and the actual owner of an email account listed here may be unaware their address is associated with this IOC list. Do not treat presence on this list as proof of wrongdoing by the account holder.

  i3 Threat Advisory: Identifying North Korean IT Workers: Key Threat Indicators — DTEX Systems · published 2025-05-14 · pulled 2026-10-26

donatelo212dunccine@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-19 · last seen 2026-10-18

Sources

• Nearby text:

  …onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …entjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gm…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

• Nearby text:

  …il.com dirono9656@eimatro.com dk5080201@gmail.com dlee59664@gmail.com dogakuto@givmail.com dom.wolf126@gmail.com don.marshall0308@gmail.com donatelo212dunccine@gmail.com donjosy305@gmail.com dp2genius@gmail.com dr.ak.e.seg.ua.l@gmail.com dragon99steel@gmail.com dragonblue927@gmail.com dragonknight0522@gmail.…

  Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

eric2022412@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …islaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

ernestpapyan@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …h0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

kevinlee2821@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …------------------------------------ Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@pro…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

leondragandevelop@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@ou…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

leonpower123@outlook.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …utlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/ta…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

ma.liguo@outlook.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …evpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower1…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

onetouch0525@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-05-14 · last seen 2026-10-18

Sources

• Nearby text:

  …Marcin Iwanski - Liguo Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …smartdevpro001@gmail.com[email protected] brentjeremynel@gmail.com[email protected] onetouch0525@gmail.com[email protected] kevinlee2821@gmail.com[email protected] leondragandevelop@gmail.com[email protected]…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-09-11

• Nearby text:

  …Iwanski): --------------------------------------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gm…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

• Per DTEX's own advisory text: these IOCs are NOT indicative of a confirmed North-Korea-attributed hack — they may have associations with IT-worker operations and require further investigation if observed in your environment. Any connection to actual persons may be deliberate (an operator using a real person's identity) or incidental, and the actual owner of an email account listed here may be unaware their address is associated with this IOC list. Do not treat presence on this list as proof of wrongdoing by the account holder.

  i3 Threat Advisory: Identifying North Korean IT Workers: Key Threat Indicators — DTEX Systems · published 2025-05-14 · pulled 2026-10-26

oskardev0112@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …ccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev h…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

promseislaw@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …promiseislaw (Marcin Iwanski) - Brent Jeremy - Marcin Iwanski - Liguo Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …Shalimov upwork.com/freelancers/~014d511b5978bb9853 promiseislaw (Marcin Iwanski): --------------------------------------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gma…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

smartdevpro001@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …promiseislaw (Marcin Iwanski) - Brent Jeremy - Marcin Iwanski - Liguo Ma - Pirachat Chaiwongrote - promseislaw@gmail.com - smartdevpro001@gmail.com - brentjeremynel@gmail.com - onetouch0525@gmail.com - kevinlee2821@gmail.com - leondragandevelop@gmail.com - eric2022412@gmail.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …(Marcin Iwanski): --------------------------------------------- Emails: promseislaw@gmail.com smartdevpro001@gmail.com brentjeremynel@gmail.com onetouch0525@gmail.com kevinlee2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.c…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

talentdev610@gmail.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …12@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

topsmartpro@prolocalize.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …leondragandevelop@gmail.com - eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …e2821@gmail.com leondragandevelop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

yatsukalbert@outlook.com

email address IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …eric2022412@gmail.com - ma.liguo@outlook.com - donatelo212dunccine@gmail.com - ernestpapyan@gmail.com - topsmartpro@prolocalize.com - yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …velop@gmail.com eric2022412@gmail.com ma.liguo@outlook.com donatelo212dunccine@gmail.com ernestpapyan@gmail.com topsmartpro@prolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https:/…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

https://github.com/brent-jeremy

github profile IT Worker FraudMoonstone Sleet MATCHED IN SOURCE removed checked 2026-08-30

Listed as brent-jeremy

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …yatsukalbert@outlook.com - talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …rolocalize.com yatsukalbert@outlook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 ht…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

https://github.com/pedrodiaz417

github profile IT Worker FraudMoonstone Sleet MATCHED IN SOURCE removed checked 2026-08-30

Listed as pedrodiaz417

First seen 2025-08-25 · last seen 2026-10-18

Sources

• …github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) •…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …b: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Telegram: smartdev19961 smartdev0205 trust0205 Discord: Talented…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-09-11

https://github.com/smart-dev-0205

github profile IT Worker FraudMoonstone Sleet MATCHED IN SOURCE removed checked 2026-08-30

Listed as smart-dev-0205

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …talentdev610@gmail.com - leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …ook.com talentdev610@gmail.com leonpower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Tele…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

https://github.com/squirdev

github profile IT Worker FraudMoonstone Sleet MATCHED IN SOURCE removed checked 2026-08-30

Listed as squirdev

First seen 2025-08-25 · last seen 2026-10-18

Sources

• …88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) •…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Telegram: smartdev19961 smartdev0205 trust0205 Discord: Talented…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-09-11

https://github.com/talented-blockchain-dev

github profile IT Worker FraudMoonstone Sleet MATCHED IN SOURCE removed checked 2026-08-30

Listed as talented-blockchain-dev

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …leonpower123@outlook.com - oskardev0112@gmail.com - 88yurchak@gmail.com - github.com/brent-jeremy - github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) •…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …npower123@outlook.com oskardev0112@gmail.com 88yurchak@gmail.com Github: https://github.com/brent-jeremy https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Telegram: smartdev19961 smartdev0205 trust0205…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

https://github.com/topsmartpro

github profile IT Worker FraudMoonstone Sleet MATCHED IN SOURCE removed checked 2026-08-30

Listed as topsmartpro

First seen 2025-08-25 · last seen 2026-10-18

Sources

• …github.com/Smart-Dev-0205 - github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID:…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-08-30

• Nearby text:

  …my https://github.com/Smart-Dev-0205 https://github.com/talented-blockchain-dev https://github.com/squirdev https://github.com/pedrodiaz417 https://github.com/topsmartpro Telegram: smartdev19961 smartdev0205 trust0205 Discord: Talented Blockchain#3570 Skype: live:.cid.ffe8d0454926464f Hiring…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-09-11

https://gitlab.com/brentjeremynel

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- brentjeremynel -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Brent Jeremy. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/brentjeremynel — Chollima Hunter · under “Marcin Iwanski / Brent Jeremy” · pulled 2026-09-18

https://gitlab.com/donatelo212dunccine

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- donatelo212dunccine -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Dream High. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/donatelo212dunccine — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-18

https://gitlab.com/ernestpapyan

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- ernestpapyan -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/ernestpapyan — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-18

https://gitlab.com/onetouch0525

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- onetouch0525 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Jan Radu. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/onetouch0525 — Chollima Hunter · under “Marcin Iwanski / Jan Radu” · pulled 2026-09-18

https://gitlab.com/pedrodiaz417

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under pedrodiaz417, a login the index already carries for this persona on another platform. The profile gives a member-since date of 2 May 2022. It displays "PedroDiaz417", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.

  gitlab.com/PedroDiaz417 — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-13

https://gitlab.com/smartdevpro001

gitlab account IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

• Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- smartdevpro001 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Smart Dev. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  gitlab.com/smartdevpro001 — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-18

https://huggingface.co/smartdev0205

huggingface account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 17 September 2026 by asking Hugging Face whether an account exists under smartdev0205, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of SmartDev. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  huggingface.co/smartdev0205 — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-17

https://medium.com/@smartdev0205

medium account IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

• Read on 13 September 2026 from the two pages cited. The Medium account @smartdev0205 writes under the display name Promise-Is-Law, which is the handle the reporting files this operator under, and the same string is the handle of the Telegram account t.me/smartdev0205 already recorded here. It holds three stories, the earliest dated 5 December 2023 and one of them carried by the Coinmonks publication, and shows 36 followers against 13 accounts followed. Its about page states one website, brent-jeremy.github.io. That hostname is a GitHub Pages user site, which GitHub serves only from the account of the same name, so the profile is publishing github.com/brent-jeremy — an account the reporting already lists under this persona beside brentjeremynel@gmail.com and two LinkedIn accounts in the same name. Both the Pages site and the GitHub account now return 404. Because the account has been deleted the hostname is unclaimed and could be registered by an unrelated party later; what the about page fixes is the account it pointed to when it was written.

  medium.com/@smartdev0205 — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-13

brent-jeremy.github.io

personal site IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

• Read on 13 September 2026 from the two pages cited. The Medium account @smartdev0205 writes under the display name Promise-Is-Law, which is the handle the reporting files this operator under, and the same string is the handle of the Telegram account t.me/smartdev0205 already recorded here. It holds three stories, the earliest dated 5 December 2023 and one of them carried by the Coinmonks publication, and shows 36 followers against 13 accounts followed. Its about page states one website, brent-jeremy.github.io. That hostname is a GitHub Pages user site, which GitHub serves only from the account of the same name, so the profile is publishing github.com/brent-jeremy — an account the reporting already lists under this persona beside brentjeremynel@gmail.com and two LinkedIn accounts in the same name. Both the Pages site and the GitHub account now return 404. Because the account has been deleted the hostname is unclaimed and could be registered by an unrelated party later; what the about page fixes is the account it pointed to when it was written.

  medium.com/@smartdev0205/about — Chollima Hunter · under “Marcin Iwanski” · pulled 2026-09-13

live:.cid.ffe8d0454926464f

skype account IT Worker FraudMoonstone Sleet MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …t.me/trust0205 (ID: 5874346391) • ([Messages](./user-5874346391-@trust0205.txt)) - Discord Talented Blockchain#3570 - Skype live:.cid.ffe8d0454926464f - https://linkedin.com/in/promise-law - https://pl.linkedin.com/in/marcin-iwanski-b699b02b8 -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-09-01

• …Blockchain#3570 Skype: live:.cid.ffe8d0454926464f Hiring…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-09-11

https://t.me/smartdev0205

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as smartdev0205

First seen 2026-09-01 · last seen 2026-10-18

Source

• …github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID: 7659696464) - t.me/trust0205 (ID:…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-09-01

https://t.me/smartdev19961

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as smartdev19961

First seen 2026-09-01 · last seen 2026-10-18

Source

• …github.com/talented-blockchain-dev - github.com/squirdev - github.com/pedrodiaz417 - github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID: 7659696464) -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-09-01

https://t.me/smartdevpro

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as smartdevpro

First seen 2026-09-01 · last seen 2026-10-18

Source

• …github.com/topsmartpro - t.me/smartdev19961 - t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID: 7659696464) - t.me/trust0205 (ID: 5874346391) • ([Messages](./user-5874346391-@trust0205.txt)) - Discord Talented Blockchain#3570 -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-09-01

https://t.me/trust0205

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as trust0205

First seen 2026-09-01 · last seen 2026-10-18

Source

• …t.me/smartdev0205 (ID: 5265691090) • ([Messages](./user-5265691090-@smartdev0205.txt)) - t.me/SmartDevPro (ID: 7659696464) - t.me/trust0205 (ID: 5874346391) • ([Messages](./user-5874346391-@trust0205.txt)) - Discord Talented Blockchain#3570 - Skype…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-09-01

https://torre.ai/brentjeremynel

torre account IT Worker FraudMoonstone Sleet MATCHED IN SOURCE live checked 2026-11-08

Listed as brentjeremynel

First seen 2025-08-25 · last seen 2026-10-18

Sources

• Nearby text:

  …ttps://www.linkedin.com/in/brent-jeremy-47172b22a/ https://www.linkedin.com/in/brent-jeremy/ https://www.linkedin.com/in/liguo-ma-060077205 https://torre.ai/brentjeremynel?r=GLXbkZCc https://www.guru.com/freelancers/brent-jeremy https://web3.career/@marcin Personas: Brent Jeremy Marcin Iwanski Liguo…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-09-27

• Nearby text:

  …https://www.linkedin.com/in/brent-jeremy/ - https://www.linkedin.com/in/liguo-ma-060077205 - https://torre.ai/brentjeremynel?r=GLXbkZCc - https://www.guru.com/freelancers/brent-jeremy - https://web3.career/@marcin #### newstable / Jaycee Tran / Sasuke Uchiha -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “promiseislaw (Marcin Iwanski)” · published 2025-06-19 · pulled 2026-09-27