Loading malware…
FREAKYPOLL is a Python backdoor associated with Sandworm, the GRU-linked Russian threat actor also tracked as UAC-0145 in this activity. It has been observed in campaigns targeting organizations in Ukraine during 2026, particularly in operations using the ClickFix social-engineering technique. In these intrusions, victims are lured through compromised websites presenting fake CAPTCHA or verification prompts that instruct them to execute malicious PowerShell commands, leading to the deployment of multiple payloads including FREAKYPOLL.
FREAKYPOLL provides remote access to compromised Windows systems and has been described as one of Sandworm’s custom malware packages. It has been observed as a follow-on payload in broader intrusion chains that also included reconnaissance and staging components such as SCOUTCURL, GHETTOVIBE, FLUIDLEECH, and LOADLOOP. Reporting indicates that earlier stages collect host and user-environment information to assess target value, after which higher-value systems may receive persistent backdoor access through malware such as FREAKYPOLL.
The malware has been identified as a Python program distributed in compiled bytecode form. Its operational role is to maintain attacker access after initial compromise, enabling continued post-compromise activity within victim environments. At least one organizational network compromise in Ukraine has been linked to an infection involving FREAKYPOLL. The malware forms part of a broader Sandworm ecosystem that has used social engineering, trojanized software, and other tailored delivery methods against Ukrainian targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
One of the malware samples detected by CERT-UA is a Python backdoor called FreakyPoll. It gained initial access to the targeted system via the described technique and provided remote access to the attackers.
...payloads such as FLUIDLEECH, LOADLOOP, and the Python backdoor FREAKYPOLL.
...було виявлено програмний засіб FREAKYPOLL - Python-програма, що функціонально є бекдором та представлена у вигляді скомпільованого байт-коду
4 distinct techniques documented for this family, organized by ATT&CK tactic.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Python backdoor used by Sandworm that gains initial access via ClickFix-style social engineering and provides remote access to compromised systems.
A Python backdoor deployed in the UAC-0145 ClickFix campaign.
A Python backdoor used in the campaign.
A custom Sandworm malware package used in a ClickFix-enabled compromise of at least one organization in Ukraine.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.