Yellow King

Yellow King is a Telegram-based hacker-community personality, organizer, and self-described leader associated with Scisan, Anonymous internationally, and BKB UNION. Across the logs he appears less like a silent advanced operator and more like a persistent social node: rebuilding after account bans, looking for old contacts, moving people into new channels, trying to keep chats active, recruiting coders, invoking Anonymous mythology, and framing hacker communities as a geopolitical force. The strongest evidence supports describing him as a community builder with amateur-to-intermediate offensive-security exposure. He knows the vocabulary and public tools: Nmap, Dmitry, Burp Suite, Nikto, CVEs, OSINT resources, Shodan-like discovery, Proton/onion-mail discussions, and vulnerability scanning language. But the logs do not prove advanced exploitation capability. What they prove, much more clearly, is persistence, social reach, and a taste for grand narrative. Yellow King’s operating style is relational and dramatic. He constantly uses brother, sister, friend, citizens, team, leader, mission, war, and betrayer language. This makes him good at keeping loose networks emotionally attached, but it also makes his claims noisy. He is a little bit organizer, a little bit myth-maker, a little bit student, a little bit Telegram mayor, and occasionally a walking OPSEC incident wearing a crown made of screenshots.

Yellow King should be assessed as:

• A persistent Telegram-native hacktivist organizer.
• A self-identified leader/founder figure around Scisan and BKB UNION.
• A broad social connector across Anonymous-adjacent, DDoS, hacker-chat, OSINT, and Telegram-client spaces.
• A user of public reconnaissance and security tools, but not a confirmed advanced operator.
• A high-noise source whose claims require careful separation between observed fact, self-report, and fantasy.
• A moderate concern due to repeated targeting language, conspiratorial escalation, and non-cyber violent rhetoric.

He is not best described as a verified elite threat actor. A fairer read is: self-appointed mayor of a volatile hacker village — persistent, socially sticky, technically curious, overdramatic, occasionally useful, occasionally alarming, and very hard to ignore.

These counts are approximate parsed-message counts from the uploaded export. They indicate where this account appears most often, not formal membership rank.

• Anonymous internationally — primary observed home base and apparent predecessor space to Scisan 1.0.
• Scisan / Scisan 2.0 — self-branded community; Yellow King claims founder/leader-type status.
• BKB UNION — self-claimed leadership association; appears as a parallel or related team.
• DDoSHome / Scam Expose — repeated participation and networking.
• LulzSec Chat — observed contact point and Anonymous-adjacent network.
• CyberVolk — observed participation and tool discussion.
• Malevolence Sec — observed participation and relationship maintenance.
• Keymous Chat — later ideological/escalation rhetoric.
• CHX CHATTING GROUP #3 — latest observed political/cyber commentary.
• 64Gram Chat — Telegram client and forwarding/circumvention discussion.
• Chat - Azzasec — broader hacker-chat participation.

Affiliation here means observed participation, claimed association, or community proximity. It does not prove formal membership, command authority, or successful joint operations. Telegram is a soup. Do not pretend every noodle is a command structure.

The earliest visible phase is not glamorous. Yellow King appears in Hacked Modz APK and Anonymous spaces trying to reconnect with old friends, asking whether they recognize him, and describing multiple Telegram account bans. On 2023-10-24 he says his Telegram situation broke everything, that three accounts were banned, and that Kali/Linux tooling was throwing errors. He also says he cannot help with DDoS at that moment but remains supportive. This matters because the first observed Yellow King is not presenting as an advanced operator. He is rebuilding identity, infrastructure, and social access after bans. The core pattern starts here: lose account, re-enter chat, find old brothers, restore links, restart the machine. By 2023-10-29 and 2023-10-30, the language shifts toward revival. He says he wants to restart everything, that people are disappointed or tired, and that he decided to make them active. On 2023-10-30 he directly says i am your old friend yellowking. This is the first clean identity anchor in the export.

On 2024-01-01 he provides ssyellowking as an ID, asks for a friend request, and says he can add someone to a secret group. The same short sequence references multiple secret groups. Two days later, on 2024-01-03, he tells people they are his team people and from team scisan. This is an important transition: the account is no longer only recovering personal identity; it is attaching identity to a group mythology. The January material also shows a trust-heavy social model. He talks about friends, team people, and trusted chats. That becomes a recurring pattern: Yellow King tries to solve instability by turning social relationships into structure.

On 2024-03-30 he gives an origin story for Scisan, saying it comes from sci and san, with sci meaning science and san meaning Sanskrit. He adds a language-development explanation and then jokes that he is leader. This is not just trivia; it shows how he mythologizes the group. The name is not treated as a random tag. It is given a civilizational explanation, because of course it is. Telegram groups apparently cannot just have names anymore; they require lore. Around the same period he posts AI-generated explanation of exploit code and notes that ChatGPT was used. The content includes safety warnings from the AI about unauthorized exploitation. This is useful for technical assessment: he is learning, experimenting, and using AI/tooling support, but the logs suggest uneven technical maturity rather than independent advanced capability.

April 2024 is the first major escalation phase. On 2024-04-16 he states I am yellow king. On 2024-04-18 he says he is the writer of the stories, founder of the story, soul of the team, and founder of the team. This is self-mythology, but it is consistent with later claims: he sees himself as the narrative and emotional center of the group. The most important April technical/risk cluster is the BIA material. In Anonymous internationally, he discusses plans such as DDoS or information leakage, then says they should gain control of the systems of what he describes as a secret intelligence company. Minutes later he posts Nmap output for bia.gov.rs, the website of Serbia’s Security Intelligence Agency, and comments that bia is secret intelligence agency. This is evidence of:

• interest in government/intelligence targets;
• public reconnaissance activity;
• explicit unauthorized-access intent in chat language;
• public posting of scan output;
• poor operational discipline.

It is not evidence of successful compromise. It is evidence of noisy recon and target fixation. There is a difference, and it matters. On 2024-04-25 he says he is a founder and needs people for his group, then clarifies i am leader not boss. That distinction is revealing. He wants authority, but wants it framed as loyalty/community rather than command hierarchy.

May 2024 shows Scisan becoming more explicit as a managed community. On 2024-05-24, in Scisan 2.0, he tells someone that in the eyes of world they are black hats. In the same cluster, he references BKB and says there are many people in the other team for testing/victim purposes. That line is one of the more alarming cyber-risk markers in the logs. That same day, Anonymous internationally posts a channel migration notice: CHANNEL IS SHIFTED and users are told to contact @yellowking23 for the new channel link. Similar notices recur on 2024-06-02 and 2024-06-10. This is strong evidence that @yellowking23 functioned as a continuity or routing handle for channel migration. The boring part is important. Group survival is mostly boring admin work: move the room, pin the link, tell the stragglers, ban spam, repeat. Yellow King appears to do or coordinate that work. On 2024-05-26 and 2024-05-27 he talks about growing Scisan and says he told everyone in Scisan to study hacking. This supports the view that his strongest role was organizer/encourager, not necessarily lead technician.

June 2024 is dense. On 2024-06-02 he comments that some groups are not very private and directs people toward private conversation. The logs show recurring tension between wanting secrecy and constantly posting identifying details in public or semi-public chats. Classic Telegram-brain. Worrying about spies while leaving breadcrumbs in every bakery. On 2024-06-14, he discusses Proton Mail and OnionMail, saying we use proton mail and asking which is safer. The same day he claims Successfully account deleted of cp distributer by YellowKing. That is a self-reported anti-CSAM action and should be treated carefully: the stated target is clearly abusive material, but the export does not independently verify the outcome. On 2024-06-19 he claims that in Scisan 1.0 he uploaded many big website vulnerabilities. This is another self-report. It supports an image of him wanting to be seen as useful in vulnerability circles, but does not prove high-end capability. On 2024-06-27 he asks for coders, says he needs legitimate people with dedication, and discusses helping with projects that include ransomware-adjacent language and evasion tooling. Do not overread it as capability. It may simply show he was trying to recruit people who could build what he could not. But it is still a risk marker.

On 2024-07-10, he announces one year since the creation of Scisan 1.0 / Anonymous internationally and introduces a Scisan logo. This is a strong brand-building marker. He is not merely hanging around a chat; he is trying to build continuity and identity. On 2024-07-11, in CyberVolk and Cybersecurity Chat contexts, he asks about Nmap, Nikto, vulnerability scanning, old CVEs, Burp Suite, Nessus, AWVS, and how CVEs help when there are so many records. These questions are valuable because they cut through the pose. They show curiosity and learning, but also confusion about basic tool boundaries and workflow. This is not shameful; everyone starts somewhere. But it is evidence against the “elite operator” reading.

On 2025-03-06, in Major Fen Group, he gives the strongest identity and leadership self-claim in the export: I am Yellow King followed by Leader of Team Scisan and BKB UNION. He then claims the organization functions mainly in real life rather than Telegram, is private, and is divided into groups so one group does not know another. This is classic compartmentation language. Treat that as self-report. It may reflect real-world structure, aspirational LARP, or a mixture of both. The logs alone do not prove the offline organization exists at the claimed scale. The same Major Fen cluster includes serious poison-related claims and dosage/quantity talk. Specific details are intentionally omitted here. The important analytical point is that this is a non-cyber violence risk marker and should be documented soberly. It is not “edgy hacker banter” to brush off. If someone is bragging about poison in organizational language, the correct response is not to clap because the lore got spicy. On 2025-03-08, he again identifies as yellowking in CHAT / Moroccan Soldiers, showing continued handle continuity across communities.

On 2025-06-13, in Keymous Chat, he discusses “modern tactical warfare,” “guerilla warfare in real life,” a social media whistleblowing campaign, and infiltration of an intelligence agency. He also says intelligence agencies are serious issues and that he would hardly get anything from it. This cluster matters because it mixes political grievance, real-world tactics language, intelligence targeting, and activist-media strategy. The safest assessment is not that he had a real operational plan. The safer assessment is that his rhetoric had moved beyond simple chat bravado into a fantasy/planning space where cyber, media, and physical-world conflict blur together. That blur is the risk.

Across late 2025 and early 2026, the Anonymous internationally and Scisan logs include many moderation-like commands such as /ban and /captcha on. These do not prove ownership by themselves, but they support an admin/moderator or trusted-operator role inside the channel ecosystem. The sheer repetition also reinforces the practical part of the profile: whatever else he claimed, he was present enough to do maintenance. Not glamorous. Still power.

The latest observed cluster is 2026-06-09 in CHX CHATTING GROUP #3. Yellow King argues that Telegram bans and broader hacker-community disruption were not just mass reporting, but a coordinated attack on hackers. He references Pavel Durov’s arrest, channel deletions, hacker arrests, DStat-like infrastructure, CVE availability, intelligence agencies, Interpol, Mossad, CIA, FBI, India, China, and the idea that hackers uniquely challenge governments. The important thing here is not whether his theory is true. The important thing is that he uses it to build a worldview:

• hackers are uniquely threatening to states;
• governments and intelligence agencies coordinate against hacker spaces;
• bans are not moderation but political attack;
• Indian hackers need stronger representation;
• China is treated as a stronger cyber power;
• voting/protesting are framed as ineffective compared with hacker leverage.

That is the clearest ideological snapshot in the export. It is conspiratorial, geopolitical, anti-institutional, and hacker-exceptionalist.

The logs show exposure to:

• Nmap scanning and scan-output sharing.
• Dmitry / WHOIS-style reconnaissance.
• Burp Suite discussion.
• Nikto discussion.
• CVE and vulnerability-scanning discussion.
• OSINT resource lists and search tools.
• Proton Mail / OnionMail privacy questions.
• Telegram clients and forwarding restrictions.
• Public recon against government/intelligence-linked targets.
• AI-assisted code/exploit explanation.

This is enough to call him security-curious and tool-aware. It is not enough to call him advanced.

Yellow King’s cyber profile is best summarized as: Public-tool recon + hacker-community literacy + social organizing + overclaiming. He can talk the language, ask the right beginner/intermediate questions, run or repost scans, and keep a crowd moving. But the export does not prove advanced exploitation, malware development, or successful compromise of high-value targets.

Yellow King’s most consistent operational strength is not technical. It is social continuity. He repeatedly:

• searches for old contacts after bans;
• asks whether people remember him;
• calls people brother/sister/friend;
• tries to restart dead or tired chats;
• frames members as part of a team;
• moves users to new channels after disruption;
• asks for coders and helpers;
• gives people roles or honorifics;
• preserves group mythology through logos, anniversaries, and origin stories;
• uses moderation commands and ban workflows.

That is real influence, even if it is not elite hacking. Influence in Telegram scenes often looks like exactly this: being online, being emotional, remembering names, carrying links, making people feel like they are part of something bigger than a chatroom full of stickers and bad decisions.

Yellow King’s ideology is emotional, reactive, and hacker-exceptionalist rather than formally coherent. Recurring motifs:

• Anonymous-style identity: We are legion, group over individual, mission language.
• Anti-Israel / pro-Palestine framing, especially in 2023-2025 clusters.
• Suspicion of governments, intelligence agencies, Telegram moderation, and platform crackdowns.
• Belief that hackers can directly challenge governments in ways ordinary protest/voting cannot.
• Concern that India lacks visible hacker representation and should build better international hacker relations.
• Respect/fear of China’s cyber capacity.
• Interest in intelligence agencies as both adversaries and targets.
• Loyalty/betrayal worldview: friends, brothers, trusted people, betrayers, spies, traitors.

He tends to translate social instability into geopolitical drama. Sometimes that is just Telegram theater. Sometimes it is a warning sign.

• Persistent identity continuity across bans and migrations.
• Strong relationship maintenance across many chats.
• Community-building instincts.
• Ability to keep a group identity alive through disruption.
• Public-tool security familiarity.
• Willingness to learn and ask questions.
• Claimed anti-CSAM / anti-abuse action.
• Broad network across hacker, Anonymous-adjacent, DDoS, OSINT, and Telegram-client spaces.
• Strong myth-making ability, which is useful for organizing even when it is annoying.

• Heavy overclaiming and grandiosity.
• Weak OPSEC: too many public breadcrumbs.
• Technical unevenness; asks basic workflow questions while making large claims.
• Reliance on others for coding and tooling.
• Conspiratorial thinking around bans, intelligence agencies, and platform enforcement.
• Poor separation between cyber activism, real-world conflict rhetoric, and fantasy planning.
• Escalation language involving violence, poison, infiltration, and “whatever it takes” thinking.
• Public targeting language toward government/intelligence systems.

• Maintained a recognizable identity from at least 2023-10-24 to 2026-06-09.
• Rebuilt social access after repeated account bans.
• Helped maintain or route users through Scisan / Anonymous internationally channel migrations.
• Established @yellowking23 as a continuity contact point.
• Claimed founder/leader status around Scisan and BKB UNION.
• Contributed to Scisan branding, including one-year anniversary/logo framing.
• Encouraged Scisan users to study hacking.
• Posted public reconnaissance output and discussed vulnerability tooling.
• Claimed an anti-CSAM account deletion.
• Built broad cross-chat presence across hacker and Anonymous-adjacent communities.

Yellow King communicates like someone trying to turn a friend group into an order of knights. He does not simply say “join the group.” He says people are team, citizens, brothers, leaders, founders, officers, trusted people, betrayers, spies. This is emotionally effective and operationally messy. He appears to need continuity. Bans, dead chats, missing friends, forgotten names, and broken channels bother him. His response is to rebuild: restart everything, make people active, move channels, ask for coders, and retell the story of Scisan. He also projects importance onto events. A ban wave becomes an intelligence operation. A Telegram migration becomes a strategic retreat. A small group becomes an organization. A scan becomes a mission. That is the charisma and the problem in one package.

Yellow King is best understood as a Telegram-native hacktivist organizer with basic-to-intermediate security-tool exposure and strong community-maintenance instincts. He is not a confirmed advanced persistent threat actor. The logs support a more grounded profile: persistent, socially active, politically charged, and technically curious, but noisy and prone to exaggeration. His biggest impact is likely social rather than technical: keeping people connected, keeping groups alive, recruiting helpers, and giving unstable chats a shared story. That said, the risk markers are real. The BIA targeting language, BKB “testing/victim” talk, poison rhetoric, real-world warfare/infiltration language, and conspiratorial crackdown narrative should not be dismissed as harmless roleplay. He may not have the capability he implies, but capability can be borrowed through networks. A dramatic organizer with weak technical skills can still become dangerous if he finds the right coder, the wrong grievance, or enough people willing to follow the story.

Record created: 2026-06-09