Naoki Murano
Also reported as: Supermutecx
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Naoki dining with his friends”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Naoki with an American Jeep”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Naoki with his friend Jenson Collins”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Profiles and evidence
Photograph published by the registry under this persona, captioned there as “Naoki waving the flag of North Korea”. Others in it are shown as published; only the persona is attributed by the registry.
Photograph published by the registry under this persona, captioned there as “Naoki with his friends”. Others in it are shown as published; only the persona is attributed by the registry.
Identity document published by the registry under this persona, captioned there as “Naoki KYC”. The registry presents it as a document used for this identity. Its name, number and photograph are the document's own and may belong to a real person whose identity was stolen to build the persona.
Identity document published by the registry under this persona, captioned there as “Happy Naoki”. The registry presents it as a document used for this identity. Its name, number and photograph are the document's own and may belong to a real person whose identity was stolen to build the persona.
Identifiers attributed to this persona
15 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Naoki Murano |
alias | |
ccristian88@outlook.com |
email address | |
kenji@dev-email.com |
email address | |
murano@outlook.com |
email address | |
mutano1996@gmail.com |
email address | |
naokimurano@outlook.com |
email address | |
https://github.com/ccristian88 |
github profile | removed |
https://github.com/donehello |
github profile | live |
https://github.com/supermutecx |
github profile | removed |
0x44a33a4a822194d3c8402629932dd88b0ff49b09 |
wallet address | |
0x6188a9e76794e7cb337b8e5a2b91808ce34fc6d1 |
wallet address | |
0x85e0504fcd7981baa68774431099c5e2dcf074dd |
wallet address | |
0xca3b78831a101a6d6d0a153653483e3c9a90948f |
wallet address | |
0xe6c2d1d7f6ee9e4ee9f8b865d9b5931c06c9c7d1 |
wallet address | |
https://x.com/xcristian88 |
x account |
Naoki Murano
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 26 commits signed ccristian88@outlook.com, an address the lazarus.group registry publishes for this persona, to github.com/Donehello, account id 57111814, created on 28 October 2019, display name Done, with 36 public repositories.
github.com/Donehello — Chollima Hunter
ccristian88@outlook.com
email address IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 26 commits signed ccristian88@outlook.com, an address the lazarus.group registry publishes for this persona, to github.com/Donehello, account id 57111814, created on 28 October 2019, display name Done, with 36 public repositories.
github.com/Donehello — Chollima Hunter
kenji@dev-email.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
murano@outlook.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Chinyong Information Technology Cooperation Company) - naokimurano - muranox.eth - supermutecx - 0xdpta - naokimurano@outlook.com - murano@outlook.com - murano1996@gmail.com - github.com/supermutecx • [Archive](https://archive.ph/96QVA) - github.com/0xdpta -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
mutano1996@gmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
naokimurano@outlook.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…subordinate to DPRK Chinyong Information Technology Cooperation Company) - naokimurano - muranox.eth - supermutecx - 0xdpta - naokimurano@outlook.com - murano@outlook.com - murano1996@gmail.com - github.com/supermutecx • [Archive](https://archive.ph/96QVA) - github.com/0xdpta -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…ivandimov921016@outlook.com[email protected] ZachXBT Supplied: 0xm00neth@gmail.com[email protected] naokimurano@outlook.com[email protected] joshupgig@gmail.com[email protected] smart.solidity@gmail.com[email protected] Crypto Wallets: Note: These are…
From Vientiane to Vladivostok — Chollima Group -
…Supplied: 0xm00neth@gmail.com naokimurano@outlook.com joshupgig@gmail.com smart.solidity@gmail.com Crypto Wallets: Note: These are low confidence.…
From Vientiane to Vladivostok — Chollima Group
https://github.com/ccristian88
github profile IT Worker Fraud THIRD-PARTY REGISTRY removed
removed
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/donehello
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 26 commits signed ccristian88@outlook.com, an address the lazarus.group registry publishes for this persona, to github.com/Donehello, account id 57111814, created on 28 October 2019, display name Done, with 36 public repositories.
github.com/Donehello — Chollima Hunter
https://github.com/supermutecx
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as supermutecx
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…naokimurano - muranox.eth - supermutecx - 0xdpta - naokimurano@outlook.com - murano@outlook.com - murano1996@gmail.com - github.com/supermutecx • [Archive](https://archive.ph/96QVA) - github.com/0xdpta - 0x85e0504fcd7981baa68774431099c5e2dcf074dd -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0x44a33a4a822194d3c8402629932dd88b0ff49b09
wallet address IT Worker Fraud MATCHED IN SOURCE
Listed as Ethereum
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…github.com/0xdpta - 0x85e0504fcd7981baa68774431099c5e2dcf074dd - 0x6188a9e76794e7cb337b8e5a2b91808ce34fc6d1 - 0x44A33a4a822194d3C8402629932dd88B0FF49b09 CryptoUnity Deployer - 0xe6c2d1d7f6ee9e4ee9f8b865d9b5931c06c9c7d1 os:murano1205 - 0xca3b78831a101a6d6d0a153653483e3c9a90948f -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0x6188a9e76794e7cb337b8e5a2b91808ce34fc6d1
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x85e0504fcd7981baa68774431099c5e2dcf074dd
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xca3b78831a101a6d6d0a153653483e3c9a90948f
wallet address IT Worker Fraud MATCHED IN SOURCE
Listed as Ethereum
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…0x44A33a4a822194d3C8402629932dd88B0FF49b09 CryptoUnity Deployer - 0xe6c2d1d7f6ee9e4ee9f8b865d9b5931c06c9c7d1 os:murano1205 - 0xca3b78831a101a6d6d0a153653483e3c9a90948f - 0xc8ad881deb9c02039795c111f2e661894b026ab0 (maybe?) - [Exposing DPRK's Cyber Syndicate and Hidden IT…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0xe6c2d1d7f6ee9e4ee9f8b865d9b5931c06c9c7d1
wallet address IT Worker Fraud MATCHED IN SOURCE
Listed as Ethereum
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…0x6188a9e76794e7cb337b8e5a2b91808ce34fc6d1 - 0x44A33a4a822194d3C8402629932dd88B0FF49b09 CryptoUnity Deployer - 0xe6c2d1d7f6ee9e4ee9f8b865d9b5931c06c9c7d1 os:murano1205 - 0xca3b78831a101a6d6d0a153653483e3c9a90948f - 0xc8ad881deb9c02039795c111f2e661894b026ab0 (maybe?) - [Exposing DPRK's…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://x.com/xcristian88
x account IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- From Vientiane to Vladivostok — Chollima Group
- lazarus.group/team/naoki-murano — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- github.com/Donehello — Chollima Hunter