Loading threat actor…
yokyok is an apparently low-visibility criminal intrusion set associated with compromises of internet-exposed PBX and VoIP platforms, particularly FreePBX ecosystems. The name is known primarily from signature strings embedded in webshells or related artifacts, and it has been identified as one of several competing actors whose implants were explicitly removed by a rival VoIP-focused malware operation seeking exclusive control of compromised telephony servers for toll-fraud activity. High-confidence reporting does not currently support a fuller independent attribution, organizational structure, or confirmed malware family beyond the use of the string "yokyok" as a webshell signature. Available evidence places yokyok within a broader criminal environment centered on unauthorized access to PBX infrastructure, where actors deploy webshells, maintain persistence, and compete for control of victim systems that can be abused for fraudulent call routing and related telephony abuse. Because the currently available information is limited, specific tactics, victimology, geographic origin, and operational scope for yokyok cannot be established with high confidence beyond its apparent association with webshell-based access on VoIP infrastructure.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.