Pham Hoang Quy
Also reported as: neverm25angler0825
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Pham Hoang Quy.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Identifiers attributed to this persona
6 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Pham Hoang Quy |
alias | |
phongquyeth@gmail.com |
email address | |
https://github.com/angler0825 |
github profile | removed |
https://github.com/neverm25 |
github profile | live |
https://t.me/neverm25 |
telegram account | live |
0xc5077eb65e6ec48d6e17d42a779e2677005aec87 |
wallet address |
Pham Hoang Quy
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/pham-hoang-quy — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 18 September 2026 by putting neverm25, the GitHub login the index already holds for this operator, to Maigret's username search and reading the Telegram page it reported, cited here. The page states the display name nevermind0825, of which the handle is a contraction, and no bio. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
t.me/neverm25 — Chollima Hunter
phongquyeth@gmail.com
email address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/pham-hoang-quy — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/angler0825
github profile IT Worker Fraud THIRD-PARTY REGISTRY removed
removed
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/pham-hoang-quy — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://github.com/neverm25
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as neverm25
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/pham-hoang-quy — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…yamamotoziro.0113 - blockchaindeveloper777@gmail.com #### Lucas Steve Moore #### Misc - never08mind25@gmail.com - github.com/neverm25 - denisleedragon@outlook.com - densyaou@gmail.com - eliteknightgold@outlook.com - github.com/Hiccup19940325 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…Github: github.com/Hiccup19940325 github.com/neverm25 github.com/seosigoto github.com/JCollinsX github.com/mtfuji25 github.com/supermutexc github.com/call-by Persona Names: Seo…
From Vientiane to Vladivostok — Chollima Group
https://t.me/neverm25
telegram account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by putting neverm25, the GitHub login the index already holds for this operator, to Maigret's username search and reading the Telegram page it reported, cited here. The page states the display name nevermind0825, of which the handle is a contraction, and no bio. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
t.me/neverm25 — Chollima Hunter
0xc5077eb65e6ec48d6e17d42a779e2677005aec87
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/pham-hoang-quy — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- From Vientiane to Vladivostok — Chollima Group
- lazarus.group/team/pham-hoang-quy — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- t.me/neverm25 — Chollima Hunter