Scott Brown
Also reported as: Kyle LarsenSean Daybreavedevbraverdevernevermindhimverytinydeverscott.brown0629
A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.
Profiles and evidence
Avatar published by the registry under this persona, captioned there as “Scott Brown avatar.”. It is the picture the identity presented, not a likeness of anyone.
LinkedIn accounts
scott-brown-813445279
removed
linkedin profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as scott-brown-813445279
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 - dev.to/scott_brown_b611d05a865cf - www.impaxrecruitment.com/wp-content/uploads/elementor/forms/6786f200b23aa.pdf -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
scott-brown-b947ba29a
removed
linkedin profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as scott-brown-b947ba29a
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 - dev.to/scott_brown_b611d05a865cf -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Identifiers reported alongside
19 indicators filed under the same heading, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
braverdever |
alias | |
Kyle Larsen |
alias | |
Scott Brown |
alias | |
Sean Day |
alias | |
https://dev.to/scott_brown_b611d05a865cf |
devto account | |
https://hub.docker.com/u/scottbrown0629 |
dockerhub account | live |
scottbrown0629@gmail.com |
email address | |
sctbrown0629@gmail.com |
email address | |
whatafabulous1@gmail.com |
email address | |
https://github.com/breavedev |
github profile | removed |
https://github.com/nevermindhim |
github profile | removed |
https://github.com/verytinydever |
github profile | removed |
https://gitlab.com/scottbrown0629 |
gitlab account | |
0x368a337dcdec5cf9849a7563538f03b1516a3f7d |
wallet address | |
0x38a35ab4235ce7c8b5c4733cee7de9e28e348acb |
wallet address | |
0x3b8cc82f5d3ec89d88c58504ecfefe4597020840 |
wallet address | |
0xa8cb25ddf0a7195bdc3232ac6e1d812c8a4713fe |
wallet address | |
0xb25a0580ddf68d4aea11d83f1655016e9520f51a |
wallet address | |
0xce0113e71ce0273d0504a7ef1cd4f0e6e4d196bc |
wallet address |
braverdever
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Kyle Larsen
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Scott Brown
alias IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under scott_brown_b611d05a865cf, a login the index already carries for this persona on another platform. It gives a joined date of Jul 22, 2024. It displays the name Scott Brown, the same name the reporting already gives. The profile links a GitHub account, nevermindhim. It gives a location of Bergen, Norway. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/scott_brown_b611d05a865cf — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- scottbrown0629 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Scott Brown. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/scottbrown0629 — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- scottbrown0629 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 October 2024 and a display name of Scott Brown. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/scottbrown0629 — Chollima Hunter
Sean Day
alias IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
https://dev.to/scott_brown_b611d05a865cf
devto account IT Worker Fraud CURATED live
Listed as scott_brown_b611d05a865cf
live
Sources
-
Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under scott_brown_b611d05a865cf, a login the index already carries for this persona on another platform. It gives a joined date of Jul 22, 2024. It displays the name Scott Brown, the same name the reporting already gives. The profile links a GitHub account, nevermindhim. It gives a location of Bergen, Norway. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/scott_brown_b611d05a865cf — Chollima Hunter -
…github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 - dev.to/scott_brown_b611d05a865cf - www.impaxrecruitment.com/wp-content/uploads/elementor/forms/6786f200b23aa.pdf - 0x3b8cc82f5d3ec89d88c58504ecfefe4597020840 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://hub.docker.com/u/scottbrown0629
dockerhub account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- scottbrown0629 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 16 October 2024 and a display name of Scott Brown. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/scottbrown0629 — Chollima Hunter
scottbrown0629@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as scott.brown0629@gmail.com
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…minamotohitoshi912@gmail.com[email protected] muhammadhamid4760@gmail.com[email protected] scott.brown0629@gmail.com[email protected] scott.brown00629@gmail.com[email protected] guzmandelfino1992@gmail.com[email protected]…
Inside the North Korean Infiltrator Threat - Flare | Identity First Threat Intelligence | Unmatched Visibility into Cybercrime — Flare -
…Scott Brown & Co #### Scott Brown - aka Kyle Larsen, Sean Day - breavedev - nevermindhim - verytinydever - scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) -
…yspalliero408@gmail.com jackkarlsson1025@gmail.com adambinharun1010@gmail.com minamotohitoshi912@gmail.com muhammadhamid4760@gmail.com scott.brown0629@gmail.com scott.brown00629@gmail.com guzmandelfino1992@gmail.com codelover111@gmail.com alexnikolaos007@gmail.com botofprince@gmail.com jaggius…
Inside the North Korean Infiltrator Threat - Flare | Identity First Threat Intelligence | Unmatched Visibility into Cybercrime — Flare
sctbrown0629@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as sct.brown0629@gmail.com
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…Sean Day - breavedev - nevermindhim - verytinydever - scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
whatafabulous1@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as what.a.fabulous1@gmail.com
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…@gmail.com m.in.space45@gmail.com derek.otieno.2020@gmail.com usmanjaggi1@gmail.com mr.martin.adrian@gmail.com kalezhang000@gmail.com what.a.fabulous1@gmail.com tinydever@gmail.com dashhello4@gmail.com simonbergman516@gmail.com robertgreen1217@gmail.com ashleyspalliero408@gmail.com jackkarlsso…
Inside the North Korean Infiltrator Threat - Flare | Identity First Threat Intelligence | Unmatched Visibility into Cybercrime — Flare -
…Scott Brown - aka Kyle Larsen, Sean Day - breavedev - nevermindhim - verytinydever - scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/breavedev
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as breavedev
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…nevermindhim - verytinydever - scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/nevermindhim
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as nevermindhim
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…scott.brown0629 - scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/verytinydever
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as verytinydever
removed
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
…scott.brown0629@gmail.com - what.a.fabulous1@gmail.com - sct.brown0629@gmail.com - github.com/breavedev - github.com/nevermindhim - github.com/verytinydever - linkedin.com/in/scott-brown-b947ba29a - linkedin.com/in/scott-brown-813445279 - dev.to/scott_brown_b611d05a865cf -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://gitlab.com/scottbrown0629
gitlab account IT Worker Fraud CURATED
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- scottbrown0629 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Scott Brown. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/scottbrown0629 — Chollima Hunter
0x368a337dcdec5cf9849a7563538f03b1516a3f7d
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x38a35ab4235ce7c8b5c4733cee7de9e28e348acb
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0x3b8cc82f5d3ec89d88c58504ecfefe4597020840
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xa8cb25ddf0a7195bdc3232ac6e1d812c8a4713fe
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Also listed under Joel Kursala — this value’s page names all of them.
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/joel-kursala — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xb25a0580ddf68d4aea11d83f1655016e9520f51a
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
0xce0113e71ce0273d0504a7ef1cd4f0e6e4d196bc
wallet address IT Worker Fraud THIRD-PARTY REGISTRY
Source
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- Inside the North Korean Infiltrator Threat - Flare | Identity First Threat Intelligence | Unmatched Visibility into Cybercrime — Flare
- lazarus.group/team/scott-brown — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- dev.to/scott_brown_b611d05a865cf — Chollima Hunter
- lazarus.group/team/joel-kursala — Lazarus Group DPRK IT-Worker Registry (lazarus.group)
- gitlab.com/scottbrown0629 — Chollima Hunter
- hub.docker.com/u/scottbrown0629 — Chollima Hunter