Public registry identifies nearly 400 North Korean IT workers and 1,000 associated wallets, emails, and handles for vetting purposes.
Regulation & Gov ·
The Security Alliance has launched a public registry of North Korean IT workers containing nearly 400 profiles and over 1,000 associated indicators—including wallet addresses, email accounts, and handles—designed to assist organizations in vetting before hiring. The resource is continuously updated and accessible at lazarus.group, drawing from public records, court filings, sanctions data, and documented incidents involving DPRK personnel and front companies.
The registry contains 395 individual profiles, 109 documented cases, 87 organizations, 272 tradecraft techniques, and 974 distinct indicators sourced from 986 public references. The original curated profiles were compiled by SEAL analysts, while sections derived from public records used AI agents to aggregate data and may contain errors—though each entry links to its underlying source. The vetting tool covers workers and facilitators associated with locations including Pyongyang, Shenyang, Vladivostok, and Vientiane.
The registry's scope and accuracy remain subject to ongoing refinement; the reliance on AI-assisted aggregation for portions of the data introduces a margin for error that organizations should account for during their own diligence processes. The full extent to which the listed indicators reflect active versus historical operations, and how frequently profiles are retired or added, is not specified.