Seo Sigoto

Also reported as: Kiwon SeoNKC04

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Seo Sigoto. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2025-07-05

Profiles and evidence

LinkedIn accounts

Identifiers reported alongside

6 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Kiwon Seo alias —
Seo Sigoto alias —
seoshigoto001@gmail.com email address —
seosigoto@gmail.com email address —
sunshineseo0614@gmail.com email address —
https://github.com/seosigoto github profile removed checked 2026-08-30

Kiwon Seo

alias IT Worker Fraud RESEARCHER POST

First seen 2025-07-05 · last seen 2025-07-05

Source

  • The post identifies the operator previously tracked as NKC04, states that he was in Laos with Naoki and was seen in Vladivostok in February 2024, that he claimed to be Japanese, and that the GitHub account had been deleted by the time of posting.
    x.com/Narcass3/status/1941322828344852865 — Narcass3 (@Narcass3) · under “Seo Sigoto / Kiwon Seo / NKC04” · published 2025-07-05 · pulled 2026-08-30

Seo Sigoto

alias IT Worker Fraud RESEARCHER POST

First seen 2025-07-05 · last seen 2025-07-05

Source

  • The post identifies the operator previously tracked as NKC04, states that he was in Laos with Naoki and was seen in Vladivostok in February 2024, that he claimed to be Japanese, and that the GitHub account had been deleted by the time of posting.
    x.com/Narcass3/status/1941322828344852865 — Narcass3 (@Narcass3) · under “Seo Sigoto / Kiwon Seo / NKC04” · published 2025-07-05 · pulled 2026-08-30

seoshigoto001@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

Listed as seo.shigoto.001@gmail.com

First seen 2025-02-18 · last seen 2026-10-18

Sources

  • The post identifies the operator previously tracked as NKC04, states that he was in Laos with Naoki and was seen in Vladivostok in February 2024, that he claimed to be Japanese, and that the GitHub account had been deleted by the time of posting.
    x.com/Narcass3/status/1941322828344852865 — Narcass3 (@Narcass3) · under “Seo Sigoto / Kiwon Seo / NKC04” · published 2025-07-05 · pulled 2026-08-30
  • Nearby text:

    …Naoki Murano - github.com/supermutexc - naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto - seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen - stevechendragon@gmail.com -…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Seo Sigoto” · published 2025-06-19 · pulled 2026-08-30
  • Nearby text:

    …JohnMichaelMillen0325@outlook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com densyaou@gmail.com zombie.eye.dev@gmail.com stevechendragon@gmail.com stevechendragon@out…
    From Vientiane to Vladivostok — Chollima Group · under “Conclusion:” · published 2025-02-18 · pulled 2026-10-18

seosigoto@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

Listed as seo.sigoto@gmail.com

First seen 2025-02-18 · last seen 2026-10-18

Sources

  • The post identifies the operator previously tracked as NKC04, states that he was in Laos with Naoki and was seen in Vladivostok in February 2024, that he claimed to be Japanese, and that the GitHub account had been deleted by the time of posting.
    x.com/Narcass3/status/1941322828344852865 — Narcass3 (@Narcass3) · under “Seo Sigoto / Kiwon Seo / NKC04” · published 2025-07-05 · pulled 2026-08-30
  • Nearby text:

    …Naoki Murano - github.com/supermutexc - naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto - seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen - stevechendragon@gmail.com - stevechendragon@outlook.com #### Ivan…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Seo Sigoto” · published 2025-06-19 · pulled 2026-08-30
  • Nearby text:

    …JohnMichaelMillen0325@outlook.com[email protected] never08mind25@gmail.com[email protected] seo.sigoto@gmail.com[email protected] sunmoonstar0319@outlook.com[email protected] blockchaindeveloper777@gmail.com[email protected]…
    From Vientiane to Vladivostok — Chollima Group · under “Conclusion:” · published 2025-02-18 · pulled 2026-09-12
  • Nearby text:

    …at chollima_group@proton.me Emails: johnmichael0325@outlook.com JohnMichaelMillen0325@outlook.com never08mind25@gmail.com seo.sigoto@gmail.com sunmoonstar0319@outlook.com blockchaindeveloper777@gmail.com seo.shigoto.001@gmail.com ivan.dimov.work@gmail.com kazune.takeda@yahoo.com de…
    From Vientiane to Vladivostok — Chollima Group · under “Conclusion:” · published 2025-02-18 · pulled 2026-10-18

sunshineseo0614@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2025-02-18 · last seen 2026-10-18

Sources

  • The post identifies the operator previously tracked as NKC04, states that he was in Laos with Naoki and was seen in Vladivostok in February 2024, that he claimed to be Japanese, and that the GitHub account had been deleted by the time of posting.
    x.com/Narcass3/status/1941322828344852865 — Narcass3 (@Narcass3) · under “Seo Sigoto / Kiwon Seo / NKC04” · published 2025-07-05 · pulled 2026-08-30
  • Nearby text:

    …naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto - seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen - stevechendragon@gmail.com - stevechendragon@outlook.com #### Ivan Dimov - ivan.dimov.work@gmail.com -…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Seo Kiwon” · published 2025-06-19 · pulled 2026-08-30
  • Nearby text:

    …@gmail.com stevechendragon@outlook.com yamamotoziro.0113@gmail.com keinakano415@gmail.com lainhong1205@gmail.com jenson.collins@hotmail.com sunshineseo0614@gmail.com watanabeatari@gmail.com sunmoonlee.19900113@outlook.com johnpatch0502@outlook.com eliteknightgold@outlook.com superdev0292@gmail.com jamesc…
    From Vientiane to Vladivostok — Chollima Group · under “Conclusion:” · published 2025-02-18 · pulled 2026-10-18

https://github.com/seosigoto

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-08-30

Listed as seosigoto

First seen 2025-02-18 · last seen 2026-10-18

Sources

  • The post identifies the operator previously tracked as NKC04, states that he was in Laos with Naoki and was seen in Vladivostok in February 2024, that he claimed to be Japanese, and that the GitHub account had been deleted by the time of posting.
    x.com/Narcass3/status/1941322828344852865 — Narcass3 (@Narcass3) · under “Seo Sigoto / Kiwon Seo / NKC04” · published 2025-07-05 · pulled 2026-08-30
  • Nearby text:

    …JohnMichaelMillen0325@outlook.com #### Naoki Murano - github.com/supermutexc - naokimurano@outlook.com #### Seo Sigoto - github.com/seosigoto - seo.shigoto.001@gmail.com - seo.sigoto@gmail.com #### Seo Kiwon - sunshineseo0614@gmail.com #### Steven Chen -…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Seo Sigoto” · published 2025-06-19 · pulled 2026-08-30
  • …Github: github.com/Hiccup19940325 github.com/neverm25 github.com/seosigoto github.com/JCollinsX github.com/mtfuji25 github.com/supermutexc github.com/call-by Persona Names: Seo Kiwon Seo Sigoto Jenson…
    From Vientiane to Vladivostok — Chollima Group · under “Conclusion:” · published 2025-02-18 · pulled 2026-09-12

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Seo Sigoto as the name of the operator is the cited researcher’s assertion, repeated here as their claim.