Pavel Yamato

Also reported as: cutelocker

A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's.

IT Worker Fraud

Identifiers attributed to this persona

7 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Pavel Yamato alias —
https://github.com/cutelocker github profile live checked 2026-09-02
0x128b782b94168ad9dcb8c7ad6cb2703f3105e687 wallet address —
0x4819f3508a35e0f92a6c9d5b6b8bbada6024c32a wallet address —
0xbc02773dc075fb3734152eb5964c67e69fe305d6 wallet address —
0xc62598078589b0f65a20e934f4d397d1e50f21d2 wallet address —
0xd040ff8d66c01029205d4a3cd7909c119666a122 wallet address —

Pavel Yamato

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/pavel-yamato — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Pavel Yamato / cutelocker” · pulled 2026-09-09

https://github.com/cutelocker

github profile IT Worker Fraud THIRD-PARTY REGISTRY live checked 2026-09-02

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/pavel-yamato — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Pavel Yamato / cutelocker” · pulled 2026-09-09

0x128b782b94168ad9dcb8c7ad6cb2703f3105e687

wallet address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/pavel-yamato — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Pavel Yamato / cutelocker” · pulled 2026-09-09

0x4819f3508a35e0f92a6c9d5b6b8bbada6024c32a

wallet address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/pavel-yamato — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Pavel Yamato / cutelocker” · pulled 2026-09-09

0xbc02773dc075fb3734152eb5964c67e69fe305d6

wallet address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/pavel-yamato — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Pavel Yamato / cutelocker” · pulled 2026-09-09

0xc62598078589b0f65a20e934f4d397d1e50f21d2

wallet address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/pavel-yamato — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Pavel Yamato / cutelocker” · pulled 2026-09-09

0xd040ff8d66c01029205d4a3cd7909c119666a122

wallet address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/pavel-yamato — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Pavel Yamato / cutelocker” · pulled 2026-09-09

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Pavel Yamato as the name of the operator is the cited researcher’s assertion, repeated here as their claim.