Paul Martin
Also reported as: Werewolves0493cryptopunkgru1125FeloniousGru-Super
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Paul Song, senior dev at Munchables.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Paul Martin profile picture.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Photograph published by the registry under this persona, captioned there as “Paul Martin / Ivar profile picture.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Identifiers attributed to this persona
11 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
cryptopunk |
alias | |
Paul Martin |
alias | |
despicablemefeloniousgru@gmail.com |
email address | |
paulmartinpm1125@gmail.com |
email address | |
https://github.com/feloniousgru-super |
github profile | removed |
https://github.com/fourfor4 |
github profile | live |
https://github.com/werewolves0493 |
github profile | removed |
0x19899a49704c7890febc139b4efa4de24d88d425 |
wallet address | |
0x1caa50f7fc5c02925ad98624b12635d11f281a00 |
wallet address | |
0x4890e32a6a631ba451b7823dad39e88614f59c97 |
wallet address | |
https://x.com/gru1125 |
x account |
cryptopunk
alias IT Worker Fraud THIRD-PARTY REGISTRY
Also listed under Pete Yama — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-cryptopunk — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/pete-yama — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Paul Martin
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-werewolves — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-cryptopunk — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/fourfor4 is account id 92280175, created on 11 October 2021, display name FourFor4. Its commits carry 92280175+feloniousgru-super@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/feloniousgru-super, renamed; that handle now returns not found. It signs 56 of the 100 commits GitHub's search returns for it with paulmartin.pm1125@gmail.com, an address the registry gives for Paul Martin, and one with despicableme.feloniousgru@gmail.com, the former handle as a mailbox.
github.com/fourfor4 — Chollima Hunter
despicablemefeloniousgru@gmail.com
email address IT Worker Fraud CURATED
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/fourfor4 is account id 92280175, created on 11 October 2021, display name FourFor4. Its commits carry 92280175+feloniousgru-super@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/feloniousgru-super, renamed; that handle now returns not found. It signs 56 of the 100 commits GitHub's search returns for it with paulmartin.pm1125@gmail.com, an address the registry gives for Paul Martin, and one with despicableme.feloniousgru@gmail.com, the former handle as a mailbox.
github.com/fourfor4 — Chollima Hunter
paulmartinpm1125@gmail.com
email address IT Worker Fraud CURATED
Listed as paulmartin.pm1125@gmail.com
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-cryptopunk — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/fourfor4 is account id 92280175, created on 11 October 2021, display name FourFor4. Its commits carry 92280175+feloniousgru-super@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/feloniousgru-super, renamed; that handle now returns not found. It signs 56 of the 100 commits GitHub's search returns for it with paulmartin.pm1125@gmail.com, an address the registry gives for Paul Martin, and one with despicableme.feloniousgru@gmail.com, the former handle as a mailbox.
github.com/fourfor4 — Chollima Hunter -
…Paul Martin / cryptopunk / gru1125 - Pixelcraft (2022) - cryptopunk - paulmartin.io - FeloniousGru-Super - paulmartin-1125.web.app - paulmartin.pm1125@gmail.com - workingnotworking.com/180375-ivar - gru1125 - github.com/FeloniousGru-Super •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/feloniousgru-super
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as feloniousgru-super
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-cryptopunk — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…workingnotworking.com/180375-ivar - gru1125 - github.com/FeloniousGru-Super • [Archive](https://web.archive.org/web/20240331015740/https://github.com/FeloniousGru-Super) - paulmartin-1125.web.app/ - xing.com/profile/Paul_Martin08403 - x.com/gru1125 - 0x19899a49704c7890febc139b4efa4de24d88d425 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/fourfor4
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/fourfor4 is account id 92280175, created on 11 October 2021, display name FourFor4. Its commits carry 92280175+feloniousgru-super@users.noreply.github.com, so it is the account lazarus.group and tayvano list as github.com/feloniousgru-super, renamed; that handle now returns not found. It signs 56 of the 100 commits GitHub's search returns for it with paulmartin.pm1125@gmail.com, an address the registry gives for Paul Martin, and one with despicableme.feloniousgru@gmail.com, the former handle as a mailbox.
github.com/fourfor4 — Chollima Hunter
https://github.com/werewolves0493
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as werewolves0493
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-werewolves — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…5102864895) - 0xf69201AA19C540b74c170A545Fc6d8805e0EE9b1 #### Paul Martin / Werewolves0493 - Munchables (2024) - Werewolves0493 - github.com/Werewolves0493 • [Archive](https://archive.ph/p8AIS) - 0x4890e32a6a631ba451b7823dad39e88614f59c97 -  -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0x19899a49704c7890febc139b4efa4de24d88d425
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-cryptopunk — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x1caa50f7fc5c02925ad98624b12635d11f281a00
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-cryptopunk — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x4890e32a6a631ba451b7823dad39e88614f59c97
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-werewolves — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://x.com/gru1125
x account IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/paul-martin-cryptopunk — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- lazarus.group/team/paul-martin-werewolves — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/paul-martin-cryptopunk — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/pete-yama — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- github.com/fourfor4 — Chollima Hunter