Loading malware…
FREAKYPOLL is a Python backdoor associated with Sandworm, the GRU-linked Russian threat actor also tracked as UAC-0145 in this activity. It has been observed in campaigns targeting organizations in Ukraine during 2026, particularly in operations using the ClickFix social-engineering technique. In these intrusions, victims are lured through compromised websites presenting fake CAPTCHA or verification prompts that instruct them to execute malicious PowerShell commands, leading to the deployment of multiple payloads including FREAKYPOLL.
FREAKYPOLL provides remote access to compromised Windows systems and has been described as one of Sandworm’s custom malware packages. It has been observed as a follow-on payload in broader intrusion chains that also included reconnaissance and staging components such as SCOUTCURL, GHETTOVIBE, FLUIDLEECH, and LOADLOOP. Reporting indicates that earlier stages collect host and user-environment information to assess target value, after which higher-value systems may receive persistent backdoor access through malware such as FREAKYPOLL.
The malware has been identified as a Python program distributed in compiled bytecode form. Its operational role is to maintain attacker access after initial compromise, enabling continued post-compromise activity within victim environments. At least one organizational network compromise in Ukraine has been linked to an infection involving FREAKYPOLL. The malware forms part of a broader Sandworm ecosystem that has used social engineering, trojanized software, and other tailored delivery methods against Ukrainian targets.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
One of the malware samples detected by CERT-UA is a Python backdoor called FreakyPoll. It gained initial access to the targeted system via the described technique and provided remote access to the attackers.
...payloads such as FLUIDLEECH, LOADLOOP, and the Python backdoor FREAKYPOLL.
...було виявлено програмний засіб FREAKYPOLL - Python-програма, що функціонально є бекдором та представлена у вигляді скомпільованого байт-коду
4 distinct techniques documented for this family, organized by ATT&CK tactic.
...a fake webpage impersonating a CAPTCHA check, browser update notice, or meeting error instructs a visitor...
CERT-UA researchers found ten websites hosting CAPTCHA pages that redirected users to web pages with malicious PowerShell commands.
It involves hosting CAPTCHA pages that mislead users into pasting PowerShell commands that execute malicious scripts on the targeted device.
The commands downloaded Visual Basic scripts and other malicious files, which in turn deployed several malware families known to be used by Sandworm.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.