Nelson Murua
Also reported as: Alberto MiraJackson BillNelsonMurua913albertomira1114super1114dev
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's.
Photograph published by the registry under this persona, captioned there as “Alberto Mira profile picture.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Alberto Mira profile picture.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Profiles and evidence
Screenshot published by the registry under this persona, captioned there as “Nelson Murua / Alberto Mira profile picture.”, kept as a record of the profile it shows.
Screenshot published by the registry under this persona, captioned there as “super1114 profile picture.”, kept as a record of the profile it shows.
Identifiers attributed to this persona
10 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Alberto Mira |
alias | |
Jackson Bill |
alias | |
Nelson Murua |
alias | |
albertomira1114@gmail.com |
email address | |
srmuruanelson@gmail.com |
email address | |
super1114dev@gmail.com |
email address | |
https://github.com/nelsonmurua913 |
github profile | removed |
https://github.com/super1114 |
github profile | removed |
0x6be96b68a46879305c905ccafff02b2519e78055 |
wallet address | |
0x9976fe30dac6063666eea87133dfad1d5ec27c5e |
wallet address |
Alberto Mira
alias IT Worker Fraud RESEARCHER POST
Also listed under KGJ — this value’s page names all of them.
Sources
-
The researcher presents all of these accounts as one operator, given only by the initials KGJ, across four posts on the same day. The first lists the X and GitHub accounts, the second names the identities Lendon Bracewell, John Faryno, Flavio Santos and Felix Martel and links a PeoplePerHour freelancer profile, and the last two list the addresses. Both spellings dev0825conscientious and dev0825conscientiouos are transcribed as published; the second looks like a typo the operator made, and correcting it would invent an address. Several of these accounts already reach this site from tayvano's research repository and the lazarus.group registry, so those records carry both citations.
x.com/browsercookies/status/1934033205709218285 — Cookie Connoisseur (@browsercookies) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Jackson Bill
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Nelson Murua
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
albertomira1114@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under KGJ — this value’s page names all of them.
Sources
-
The researcher presents all of these accounts as one operator, given only by the initials KGJ, across four posts on the same day. The first lists the X and GitHub accounts, the second names the identities Lendon Bracewell, John Faryno, Flavio Santos and Felix Martel and links a PeoplePerHour freelancer profile, and the last two list the addresses. Both spellings dev0825conscientious and dev0825conscientiouos are transcribed as published; the second looks like a typo the operator made, and correcting it would invent an address. Several of these accounts already reach this site from tayvano's research repository and the lazarus.group registry, so those records carry both citations.
x.com/browsercookies/status/1934035900499104146 — Cookie Connoisseur (@browsercookies) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…/ Alberto Mira / Jackson Bill - Munchables (2024) - NelsonMurua913 - albertomira1114 - super1114dev - sr.muruanelson@gmail.com - albertomira1114@gmail.com - super1114dev@gmail.com - github.com/NelsonMurua913 •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
srmuruanelson@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as sr.muruanelson@gmail.com
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Nelson Murua / Alberto Mira / Jackson Bill - Munchables (2024) - NelsonMurua913 - albertomira1114 - super1114dev - sr.muruanelson@gmail.com - albertomira1114@gmail.com - super1114dev@gmail.com - github.com/NelsonMurua913 •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
super1114dev@gmail.com
email address IT Worker FraudContagious Interview MATCHED IN SOURCE
Also listed under KGJ — this value’s page names all of them.
Sources
-
The researcher presents all of these accounts as one operator, given only by the initials KGJ, across four posts on the same day. The first lists the X and GitHub accounts, the second names the identities Lendon Bracewell, John Faryno, Flavio Santos and Felix Martel and links a PeoplePerHour freelancer profile, and the last two list the addresses. Both spellings dev0825conscientious and dev0825conscientiouos are transcribed as published; the second looks like a typo the operator made, and correcting it would invent an address. Several of these accounts already reach this site from tayvano's research repository and the lazarus.group registry, so those records carry both citations.
x.com/browsercookies/status/1934035900499104146 — Cookie Connoisseur (@browsercookies) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Munchables (2024) - NelsonMurua913 - albertomira1114 - super1114dev - sr.muruanelson@gmail.com - albertomira1114@gmail.com - super1114dev@gmail.com - github.com/NelsonMurua913 • [Archive](https://web.archive.org/web/20240327040031/https://github.com/nelsonmurua913) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…jsontoken-extend 2026-04-17 live registry adsila000@outlook.com levex-press 2026-03-23 live registry super1114dev@gmail.com levex-refa - - npm@npmjs.com lint-null 2026-04-13 live registry a.yal.a.da.ve7@gmail.com log-upgrade…
Inside DPRK’s npm Malware Factory: 108 Packages & 261 Versions — Panther Labs -
…{"id":"95b510313f1d166d","type":"text","text":"super1114dev@gmail.com","x":-1710,"y":6160,"width":250,"height":60,"color":"4"}, {"id":"d6cf06f0192d41d6","type":"text","text":"- [Formerly…
HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research)
https://github.com/nelsonmurua913
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as nelsonmurua913
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…NelsonMurua913 - albertomira1114 - super1114dev - sr.muruanelson@gmail.com - albertomira1114@gmail.com - super1114dev@gmail.com - github.com/NelsonMurua913 • [Archive](https://web.archive.org/web/20240327040031/https://github.com/nelsonmurua913) - github.com/super1114 •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/super1114
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as super1114
Also listed under KGJ — this value’s page names all of them.
removed
Sources
-
The researcher presents all of these accounts as one operator, given only by the initials KGJ, across four posts on the same day. The first lists the X and GitHub accounts, the second names the identities Lendon Bracewell, John Faryno, Flavio Santos and Felix Martel and links a PeoplePerHour freelancer profile, and the last two list the addresses. Both spellings dev0825conscientious and dev0825conscientiouos are transcribed as published; the second looks like a typo the operator made, and correcting it would invent an address. Several of these accounts already reach this site from tayvano's research repository and the lazarus.group registry, so those records carry both citations.
x.com/browsercookies/status/1934033205709218285 — Cookie Connoisseur (@browsercookies) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…github.com/super1114 • [Archive](https://web.archive.org/web/20220627223823/https://github.com/super1114) - crypto.jobs/talent/profile/senior-smart-contracts-developer-solidity-1 - codementor.io/@super1114dev - remote3.co/p/albertomira -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0x6be96b68a46879305c905ccafff02b2519e78055
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x9976fe30dac6063666eea87133dfad1d5ec27c5e
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- Inside DPRK’s npm Malware Factory: 108 Packages & 261 Versions — Panther
- HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research)
- x.com/browsercookies/status/1934033205709218285 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1934035900499104146 — Cookie Connoisseur (@browsercookies)
- lazarus.group/team/nelson-murua — Lazarus Group DPRK IT-Worker Registry (lazarus.group)