Russell Hieu
Also reported as: Shota NakamuraNakamura ShotaJohn PatchHelme0315johnpatch05020xRUS380xdoccerrussellhieu0xhawkk
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Profiles and evidence
Screenshot published by the registry under this persona, captioned there as “Russell Hieu 1.”, kept as a record of the profile it shows.
Screenshot published by the registry under this persona, captioned there as “Russell Hieu twitter.”, kept as a record of the profile it shows.
Avatar published by the registry under this persona, captioned there as “Russell Hieu avatar.”. It is the picture the identity presented, not a likeness of anyone.
Identifiers attributed to this persona
10 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
John Patch |
alias | |
Nakamura Shota |
alias | |
Russell Hieu |
alias | |
Shota Nakamura |
alias | |
johnpatch0502@outlook.com |
email address | |
russellhieu@outlook.com |
email address | |
https://github.com/helme0315 |
github profile | removed |
https://github.com/johnpatch0502 |
github profile | removed |
0x97467ea9bef1c925e9d8e2e65932d066869b7f13 |
wallet address | |
0xff6d86807b3387e10dde52697c3bd7f59b6a145f |
wallet address |
John Patch
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Nakamura Shota
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Russell Hieu
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed johnpatch0502@outlook.com, an address the lazarus.group registry publishes for this persona, to the login johnpatch0502, which no longer resolves.
github.com/johnpatch0502 — Chollima Hunter
Shota Nakamura
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
johnpatch0502@outlook.com
email address IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed johnpatch0502@outlook.com, an address the lazarus.group registry publishes for this persona, to the login johnpatch0502, which no longer resolves.
github.com/johnpatch0502 — Chollima Hunter -
…Nakamura Shota - John Patch - Helme0315 - johnpatch0502 - 0xRUS38 - 0xdoccer - russellhieu - johnpatch0502@outlook.com - russellhieu@outlook.com - github.com/Helme0315 • [Archive](https://archive.ph/vgsFX) - 0x97467ea9BeF1c925E9D8e2E65932d066869b7f13 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…ail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamescharlie94@outlook.com denisleedragon@outlook.com ivandimov921016@outlook.com ZachX…
From Vientiane to Vladivostok — Chollima Group
russellhieu@outlook.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Nakamura Shota - John Patch - Helme0315 - johnpatch0502 - 0xRUS38 - 0xdoccer - russellhieu - johnpatch0502@outlook.com - russellhieu@outlook.com - github.com/Helme0315 • [Archive](https://archive.ph/vgsFX) - 0x97467ea9BeF1c925E9D8e2E65932d066869b7f13 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/helme0315
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as helme0315
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…John Patch - Helme0315 - johnpatch0502 - 0xRUS38 - 0xdoccer - russellhieu - johnpatch0502@outlook.com - russellhieu@outlook.com - github.com/Helme0315 • [Archive](https://archive.ph/vgsFX) - 0x97467ea9BeF1c925E9D8e2E65932d066869b7f13 - 0xFf6d86807b3387e10dDE52697C3BD7f59b6A145f ####…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/johnpatch0502
github profile IT Worker Fraud CURATED removed
removed
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 100 commits signed johnpatch0502@outlook.com, an address the lazarus.group registry publishes for this persona, to the login johnpatch0502, which no longer resolves.
github.com/johnpatch0502 — Chollima Hunter
0x97467ea9bef1c925e9d8e2e65932d066869b7f13
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xff6d86807b3387e10dde52697c3bd7f59b6a145f
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- From Vientiane to Vladivostok — Chollima Group
- lazarus.group/team/russell-hieu — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- github.com/johnpatch0502 — Chollima Hunter