Sadao Eiichi Murano
Also reported as: John Wilhelmssonzhmollyzhmolydainmoly9omo6
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Photograph published by the registry under this persona, captioned there as “Sadao Eiichi Murano.”. It shows whoever appeared under this identity, which is not necessarily the person whose details the identity was assembled from — these operations routinely build a persona around a real, uninvolved person.
Identifiers attributed to this persona
14 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
John Wilhelmsson |
alias | |
Sadao Eiichi Murano |
alias | |
dainsm@proton.me |
email address | |
jwtradera@outlook.com |
email address | |
zhmolly@proton.me |
email address | |
https://github.com/dainmoly |
github profile | live |
https://github.com/zhmolly |
github profile | removed |
https://github.com/zhmoly |
github profile | removed |
dain-sdk |
npm package | |
2c5gD79Um49VmLCx54a89vVL84kFCiWmj82Zyg8QVVWi |
wallet address | |
AVXF5qTa937CZ9nuL2M9J2MieYRL5bw8DEXr5QnvwN9L |
wallet address | |
BrbAo3gtStKPxUbdomd14WUUAFv5QSBnFqp6NRD6TBGC |
wallet address | |
GUrBkpnjmxz6ZLBjkd8jMkkrShsYXKropKSes8UCWdqw |
wallet address | |
LAcNUB7p2VYNA8gEkmPSTdsrDBSwBjzymw5Dbt7UMvB |
wallet address |
John Wilhelmsson
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sadao Eiichi Murano
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. The npm registry entry for dain-sdk, "DAIN prediction’s TS sdk", names its author as Dainmoly — the handle this operator is already indexed under — and carries the publishing account dainsm with the address dainsm@proton.me, which this site did not hold. The package repository is github.com/dainmoly/dain-sdk, versions 0.0.1 to 0.1.1, published between 1 November 2024 and 16 January 2025. The package is recorded because of who published it, not because anything about it is malicious: nothing here says this code is harmful, and it should not be read as a detection.
registry.npmjs.org/dain-sdk — Chollima Hunter
dainsm@proton.me
email address IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. The npm registry entry for dain-sdk, "DAIN prediction’s TS sdk", names its author as Dainmoly — the handle this operator is already indexed under — and carries the publishing account dainsm with the address dainsm@proton.me, which this site did not hold. The package repository is github.com/dainmoly/dain-sdk, versions 0.0.1 to 0.1.1, published between 1 November 2024 and 16 January 2025. The package is recorded because of who published it, not because anything about it is malicious: nothing here says this code is harmful, and it should not be read as a detection.
registry.npmjs.org/dain-sdk — Chollima Hunter -
…• [Archive](https://archive.ph/snjV5) - github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/dainmoly - dainsm@proton.me - jwtradera@outook.com - t.me/jjmolIy (ID: 1968323567) • ([Messages](./user-1968323567-@zzmoly.txt)) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
jwtradera@outlook.com
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under Kazune Takeda, John Wilhelmson — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…handles - John Wilhelmsson - JeyHop - jwtradera - zhmoly - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas github.com/davidlucas0402 davidlucas0402@outlook.com -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
zhmolly@proton.me
email address IT Worker Fraud MATCHED IN SOURCE
Also listed under Kazune Takeda — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…List zachxbt/status/1824047425822310580 - David Adachi - davidadachi56@gmail.com - gigazh - dainmoly - davidlucas0402 - jwtradera - zhmolly@proton.me - zhmolly@gigadao.io - github.com/gigazh • [Archive](https://archive.ph/snjV5) - github.com/zhmolly •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/dainmoly
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as dainmoly
live
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…github.com/gigazh • [Archive](https://archive.ph/snjV5) - github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/dainmoly - dainsm@proton.me - jwtradera@outook.com - t.me/jjmolIy (ID: 1968323567) • ([Messages](./user-1968323567-@zzmoly.txt)) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/zhmolly
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as zhmolly
Also listed under Kazune Takeda — this value’s page names all of them.
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator and gives their real citizenship as North Korea. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Adachi / zhmolly - 2025 (jwtradera cluster) - sadaorome - zhmolly - zhmoly - zzmoly - 0xmolly - Moly - github.com/sadaorome - github.com/zhmolly • [Archive](https://archive.ph/80EYH) - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - t.me/zzmoly (ID: 1968323567) •…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/zhmoly
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as zhmoly
Also listed under John Wilhelmson — this value’s page names all of them.
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…John Wilhelmson / zhmolly - 2021 - Shows up all over zhmolly handles - John Wilhelmsson - JeyHop - jwtradera - zhmoly - github.com/zhmoly • [Archive](https://archive.ph/7XiAc) - Sadao Murano jwtradera@outlook.com (Naoki Cross Whoopsies) - David Lucas…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
dain-sdk
npm package IT Worker Fraud CURATED Live malware
Source
-
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. The npm registry entry for dain-sdk, "DAIN prediction’s TS sdk", names its author as Dainmoly — the handle this operator is already indexed under — and carries the publishing account dainsm with the address dainsm@proton.me, which this site did not hold. The package repository is github.com/dainmoly/dain-sdk, versions 0.0.1 to 0.1.1, published between 1 November 2024 and 16 January 2025. The package is recorded because of who published it, not because anything about it is malicious: nothing here says this code is harmful, and it should not be read as a detection.
registry.npmjs.org/dain-sdkhttps://registry.npmjs.org/dain-sdk— Chollima Hunter
2c5gD79Um49VmLCx54a89vVL84kFCiWmj82Zyg8QVVWi
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
AVXF5qTa937CZ9nuL2M9J2MieYRL5bw8DEXr5QnvwN9L
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
BrbAo3gtStKPxUbdomd14WUUAFv5QSBnFqp6NRD6TBGC
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
GUrBkpnjmxz6ZLBjkd8jMkkrShsYXKropKSes8UCWdqw
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
LAcNUB7p2VYNA8gEkmPSTdsrDBSwBjzymw5Dbt7UMvB
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- lazarus.group/team/kazune-takeda — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- lazarus.group/team/john-wilhelmsson — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- registry.npmjs.org/dain-sdk — Chollima Hunter