Motoki Masuo
Also reported as: Hiroto Iwakimymiracle0118iwakihirotonoahsflood908Taku Yamamotobestselection18
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Motoki Masuo. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Photograph published by the registry under this persona, captioned there as “Profile picture of Hiroto Iwaki.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Motoki Masuo on call”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Profiles and evidence
Screenshot published by the registry under this persona, captioned there as “Profile picture of Hiroto Iwaki.”, kept as a record of the profile it shows.
LinkedIn accounts
https://www.linkedin.com/in/hiroto-iwaki-54b207306/
removed
linkedin profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as hiroto-iwaki-54b207306
Also listed under Hiroto Iwaki — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which publishes this identity on a page of its own and also lists Hiroto Iwaki as a fake name on its Motoki Masuo page, filing the same address under both. It is carried here as one persona on the registry's own assertion that the two names belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/hiroto-iwaki — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Hiroto Iwaki / Taku Yamamoto / Iwaki Hiroto - mymiracle0118 - iwakihiroto - noahsflood908 - noahsflood908@gmail.com - linkedin.com/in/hiroto-iwaki-54b207306 - github.com/mymiracle0118 • [Archive](https://web.archive.org/web/20240115053832/https://github.com/mymiracle0118) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Identifiers reported alongside
10 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Hiroto Iwaki |
alias | |
Motoki Masuo |
alias | |
Taku Yamamoto |
alias | |
noahsflood908@gmail.com |
email address | |
https://github.com/knownothing10 |
github profile | live |
https://github.com/mymiracle0118 |
github profile | removed |
https://t.me/iwakihiroto |
telegram account | live |
0xe32418e9d4392155dc20ce932ff90d437a6e0c85 |
wallet address | |
1JKM1dZ8nHHqqwVCXUMRN8r7zkYD6981y |
wallet address | |
61mt2SSFNhpaiR4LCLadKoQwYuRUDvogM7ZFUJUwB8as |
wallet address |
Hiroto Iwaki
alias IT Worker Fraud CURATED
Also listed under Hiroto Iwaki — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which publishes this identity on a page of its own and also lists Hiroto Iwaki as a fake name on its Motoki Masuo page, filing the same address under both. It is carried here as one persona on the registry's own assertion that the two names belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/hiroto-iwaki — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/motoki-masuo — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 12 September 2026 by searching the open web for the handles this site already holds for this operator. The page is a jobseeker profile on Cryptojobslist under the handle iwakihiroto, which is the GitHub login a researcher attributes to this persona, and it advertises for work: "Full stack blockchain developer and smart contract security auditor in Japan. Remote, Part-time, Full-time. In crypto since 2020." The full name and any linked accounts sit behind a sign-in, so only what the page shows anonymously is recorded. That the handle is the same is the link; nothing here establishes that the same person holds both.
cryptojobslist.com/@iwakihiroto — Chollima Hunter
Motoki Masuo
alias IT Worker Fraud CURATED
Sources
-
The report gives these EVM, Solana and Bitcoin addresses as Motoki Masuo's payment addresses.
www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html — Heiner García -
Entry in the lazarus.group DPRK IT-worker registry, which publishes this identity on a page of its own and also lists Hiroto Iwaki as a fake name on its Motoki Masuo page, filing the same address under both. It is carried here as one persona on the registry's own assertion that the two names belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/hiroto-iwaki — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/motoki-masuo — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed noahsflood908@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/knownothing10, account id 146400751, created on 29 September 2023, display name Know Nothing, with 56 public repositories.
github.com/knownothing10 — Chollima Hunter
Taku Yamamoto
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which publishes this identity on a page of its own and also lists Hiroto Iwaki as a fake name on its Motoki Masuo page, filing the same address under both. It is carried here as one persona on the registry's own assertion that the two names belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/hiroto-iwaki — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
noahsflood908@gmail.com
email address IT Worker Fraud CURATED
Also listed under Hiroto Iwaki — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which publishes this identity on a page of its own and also lists Hiroto Iwaki as a fake name on its Motoki Masuo page, filing the same address under both. It is carried here as one persona on the registry's own assertion that the two names belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/hiroto-iwaki — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/motoki-masuo — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed noahsflood908@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/knownothing10, account id 146400751, created on 29 September 2023, display name Know Nothing, with 56 public repositories.
github.com/knownothing10 — Chollima Hunter -
…6251624532) - rok.co/@alek806 --- #### Hiroto Iwaki / Taku Yamamoto / Iwaki Hiroto - mymiracle0118 - iwakihiroto - noahsflood908 - noahsflood908@gmail.com - linkedin.com/in/hiroto-iwaki-54b207306 - github.com/mymiracle0118 •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…bestselection18 appears as the most recent and currently active identity; however, the noahsflood908@gmail.com email bestselection18 uses was also attached to: mymiracle0118 GitHub handle, currently deleted. SweetDream GitHub handle, which…
DPRK IT Workers in Open Source and Freelance Platforms - Ketman - Threat intelligence for remote and open source organizations — ketman.org
https://github.com/knownothing10
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed noahsflood908@gmail.com, an address the lazarus.group registry publishes for this persona, to github.com/knownothing10, account id 146400751, created on 29 September 2023, display name Know Nothing, with 56 public repositories.
github.com/knownothing10 — Chollima Hunter
https://github.com/mymiracle0118
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as mymiracle0118
Also listed under Hiroto Iwaki — this value’s page names all of them.
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which publishes this identity on a page of its own and also lists Hiroto Iwaki as a fake name on its Motoki Masuo page, filing the same address under both. It is carried here as one persona on the registry's own assertion that the two names belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/hiroto-iwaki — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…/ Iwaki Hiroto - mymiracle0118 - iwakihiroto - noahsflood908 - noahsflood908@gmail.com - linkedin.com/in/hiroto-iwaki-54b207306 - github.com/mymiracle0118 • [Archive](https://web.archive.org/web/20240115053832/https://github.com/mymiracle0118) - iwakihiroto-portfolio.vercel.app -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…https://github.com/kirbyAttack https://github.com/legendx0333 https://github.com/lionstar259007 https://github.com/motokimasuo https://github.com/mymiracle0118 https://github.com/swdreams https://github.com/toptalhook https://github.com/techeng322 https://github.com/tranguixdev…
DPRK IT Workers in Open Source and Freelance Platforms - Ketman - Threat intelligence for remote and open source organizations — ketman.org
https://t.me/iwakihiroto
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as iwakihiroto
Also listed under Hiroto Iwaki — this value’s page names all of them.
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which publishes this identity on a page of its own and also lists Hiroto Iwaki as a fake name on its Motoki Masuo page, filing the same address under both. It is carried here as one persona on the registry's own assertion that the two names belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/hiroto-iwaki — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…• [Archive](https://web.archive.org/web/20240115053832/https://github.com/mymiracle0118) - iwakihiroto-portfolio.vercel.app - t.me/iwakihiroto (ID: 7074147770) • ([Messages](./user-7074147770-@iwakihiroto.txt)) - https://x.com/blackbigswan/status/1913290058670416183 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0xe32418e9d4392155dc20ce932ff90d437a6e0c85
wallet address IT Worker Fraud RESEARCHER POST
Source
-
The report gives these EVM, Solana and Bitcoin addresses as Motoki Masuo's payment addresses.
www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html — Heiner García
1JKM1dZ8nHHqqwVCXUMRN8r7zkYD6981y
wallet address IT Worker Fraud RESEARCHER POST
Source
-
The report gives these EVM, Solana and Bitcoin addresses as Motoki Masuo's payment addresses.
www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html — Heiner García
61mt2SSFNhpaiR4LCLadKoQwYuRUDvogM7ZFUJUwB8as
wallet address IT Worker Fraud RESEARCHER POST
Source
-
The report gives these EVM, Solana and Bitcoin addresses as Motoki Masuo's payment addresses.
www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html — Heiner García
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- DPRK IT Workers in Open Source and Freelance Platforms - Ketman - Threat intelligence for remote and open source organizations — ketman.org
- www.ketman.org/understanding-dprk-it-workers-conversations-and-insight.html — Heiner García
- lazarus.group/team/hiroto-iwaki — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/motoki-masuo — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- cryptojobslist.com/@iwakihiroto — Chollima Hunter
- github.com/knownothing10 — Chollima Hunter