Quinn Lee
Also reported as: QuinnDuckletteldreamrustumatizon0xkonka0xfury
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Profiles and evidence
Avatar published by the registry under this persona, captioned there as “Quinn Lee avatar.”. It is the picture the identity presented, not a likeness of anyone.
Identifiers attributed to this persona
10 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Quinn Lee |
alias | |
8722069+0xkonka@users.noreply.github.com |
email address | |
8722069+rustumatizon@users.noreply.github.com |
email address | |
letteldream@gmail.com |
email address | |
https://github.com/letteldream |
github profile | removed |
https://github.com/markedbit |
github profile | live |
https://github.com/rustumatizon |
github profile | removed |
https://t.me/quinnduck |
telegram account | live |
0x9de5d3158b0b83e9211c7444c94ce0c53763f574 |
wallet address | |
0xf9adac8658e08893fb4e91c1062e471eb11cb6c7 |
wallet address |
Quinn Lee
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/quinn-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry gives for a persona, and keeping the accounts whose own repositories are committed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/markedBit is account id 8722069, created on 10 September 2014. Its commits carry 8722069+rustumatizon@users.noreply.github.com and 8722069+0xkonka@users.noreply.github.com, so it is the account lazarus.group lists for Quinn Lee as github.com/rustumatizon, and tayvano lists under the same handle, renamed twice; rustumatizon now returns not found. GitHub attributes 2,316 commits to it. Its repositories, uploaded in August 2024 and March 2025, are projects it worked on with other developers at the time, and in them it commits beside three registry personas: letteldream@gmail.com, which the registry gives for Quinn Lee, in CDP-interface (26 commits, February 2024), Brewlabs-UI and Gravita-upgrade; cloudrider.m92@gmail.com and the account firstninja111, which the registry gives for Jordan Lopez, in CDP-interface and CDP-backend; and smart.solidity@gmail.com, which it gives for Kang Tae Bok (listed at lazarus.group/team/joshua-palmer), in oasis-backend, where 35 commits between August 2023 and February 2024 carry that address.
github.com/markedBit — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed letteldream@gmail.com, an address the lazarus.group registry publishes for this persona, to the login letteldream, which no longer resolves.
github.com/letteldream — Chollima Hunter
8722069+0xkonka@users.noreply.github.com
email address IT Worker Fraud CURATED
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry gives for a persona, and keeping the accounts whose own repositories are committed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/markedBit is account id 8722069, created on 10 September 2014. Its commits carry 8722069+rustumatizon@users.noreply.github.com and 8722069+0xkonka@users.noreply.github.com, so it is the account lazarus.group lists for Quinn Lee as github.com/rustumatizon, and tayvano lists under the same handle, renamed twice; rustumatizon now returns not found. GitHub attributes 2,316 commits to it. Its repositories, uploaded in August 2024 and March 2025, are projects it worked on with other developers at the time, and in them it commits beside three registry personas: letteldream@gmail.com, which the registry gives for Quinn Lee, in CDP-interface (26 commits, February 2024), Brewlabs-UI and Gravita-upgrade; cloudrider.m92@gmail.com and the account firstninja111, which the registry gives for Jordan Lopez, in CDP-interface and CDP-backend; and smart.solidity@gmail.com, which it gives for Kang Tae Bok (listed at lazarus.group/team/joshua-palmer), in oasis-backend, where 35 commits between August 2023 and February 2024 carry that address.
github.com/markedBit — Chollima Hunter
8722069+rustumatizon@users.noreply.github.com
email address IT Worker Fraud CURATED
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry gives for a persona, and keeping the accounts whose own repositories are committed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/markedBit is account id 8722069, created on 10 September 2014. Its commits carry 8722069+rustumatizon@users.noreply.github.com and 8722069+0xkonka@users.noreply.github.com, so it is the account lazarus.group lists for Quinn Lee as github.com/rustumatizon, and tayvano lists under the same handle, renamed twice; rustumatizon now returns not found. GitHub attributes 2,316 commits to it. Its repositories, uploaded in August 2024 and March 2025, are projects it worked on with other developers at the time, and in them it commits beside three registry personas: letteldream@gmail.com, which the registry gives for Quinn Lee, in CDP-interface (26 commits, February 2024), Brewlabs-UI and Gravita-upgrade; cloudrider.m92@gmail.com and the account firstninja111, which the registry gives for Jordan Lopez, in CDP-interface and CDP-backend; and smart.solidity@gmail.com, which it gives for Kang Tae Bok (listed at lazarus.group/team/joshua-palmer), in oasis-backend, where 35 commits between August 2023 and February 2024 carry that address.
github.com/markedBit — Chollima Hunter
letteldream@gmail.com
email address IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/quinn-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed letteldream@gmail.com, an address the lazarus.group registry publishes for this persona, to the login letteldream, which no longer resolves.
github.com/letteldream — Chollima Hunter -
…Arc Market?, Fastswap?, Grape Finance? - QuinnDuck - letteldream - rustumatizon - letteldream@gmail.com - github.com/rustumatizon • [Archive](https://archive.ph/KLBYw) - t.me/QuinnDuck - https://quinn-lee.netlify.app/ -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/letteldream
github profile IT Worker Fraud CURATED removed
removed
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed letteldream@gmail.com, an address the lazarus.group registry publishes for this persona, to the login letteldream, which no longer resolves.
github.com/letteldream — Chollima Hunter
https://github.com/markedbit
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry gives for a persona, and keeping the accounts whose own repositories are committed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/markedBit is account id 8722069, created on 10 September 2014. Its commits carry 8722069+rustumatizon@users.noreply.github.com and 8722069+0xkonka@users.noreply.github.com, so it is the account lazarus.group lists for Quinn Lee as github.com/rustumatizon, and tayvano lists under the same handle, renamed twice; rustumatizon now returns not found. GitHub attributes 2,316 commits to it. Its repositories, uploaded in August 2024 and March 2025, are projects it worked on with other developers at the time, and in them it commits beside three registry personas: letteldream@gmail.com, which the registry gives for Quinn Lee, in CDP-interface (26 commits, February 2024), Brewlabs-UI and Gravita-upgrade; cloudrider.m92@gmail.com and the account firstninja111, which the registry gives for Jordan Lopez, in CDP-interface and CDP-backend; and smart.solidity@gmail.com, which it gives for Kang Tae Bok (listed at lazarus.group/team/joshua-palmer), in oasis-backend, where 35 commits between August 2023 and February 2024 carry that address.
github.com/markedBit — Chollima Hunter
https://github.com/rustumatizon
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as rustumatizon
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/quinn-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Arc Market?, Fastswap?, Grape Finance? - QuinnDuck - letteldream - rustumatizon - letteldream@gmail.com - github.com/rustumatizon • [Archive](https://archive.ph/KLBYw) - t.me/QuinnDuck - https://quinn-lee.netlify.app/ -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://t.me/quinnduck
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as quinnduck
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/quinn-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…QuinnDuck - letteldream - rustumatizon - letteldream@gmail.com - github.com/rustumatizon • [Archive](https://archive.ph/KLBYw) - t.me/QuinnDuck - https://quinn-lee.netlify.app/ - https://laborx.com/freelancers/users/id126269 - 0xf9adac8658e08893fb4e91c1062e471eb11cb6c7 (T) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
0x9de5d3158b0b83e9211c7444c94ce0c53763f574
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/quinn-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xf9adac8658e08893fb4e91c1062e471eb11cb6c7
wallet address IT Worker Fraud MATCHED IN SOURCE
Listed as Ethereum
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/quinn-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
… #### "Zhang Meihong" to China Accts - 0xCF3f54b780aC180Ed57F3227C96BCF9B2FD7415A - 0xF9AdaC8658E08893fB4E91c1062e471eb11Cb6c7 > Some DPRK cyber actors also maintain their own accounts at Chinese financial institutions for laundering purposes.…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- lazarus.group/team/quinn-lee — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- github.com/markedBit — Chollima Hunter
- github.com/letteldream — Chollima Hunter