Hackers target Ukrainian and Russian emergency alert apps with fake threats

Cyberattacks on emergency alert systems

Emergency alert mobile applications in both Ukraine and Russia were targeted by cyberattacks over the weekend, resulting in the dissemination of false warnings.

In Ukraine, the Air Alert app—developed by Ajax Systems and Stfalcon with support from Ukraine's Ministry of Digital Transformation—began sending false notifications at approximately 10:47 p.m. local time on Sunday. The messages, which were written in English, Ukrainian, and Russian, falsely warned residents in Kyiv of an imminent nuclear strike, radiation hazards, chemical threats, and street-to-street fighting. One Russian-language message stated, “There will be a nuclear threat across Ukraine. Do not worry, the Oreshnik is incoming,” referring to a Russian ballistic missile.

Hours later, at approximately 2:45 a.m. Moscow time on Monday, Russia's Emergencies Ministry reported its own app had suffered a "massive cyberattack." According to Russian media, the hack resulted in false alerts being sent to users in 33 of the country's 89 regions. These messages reportedly warned of "nuclear warheads" being launched and instructed residents to stock up on food for three weeks and seek shelter in basements.

Attribution and official responses

It remains unclear if the two attacks are connected or who is responsible for them. A Russian Telegram channel, Mash, reported that a hacking group called Hitcore claimed responsibility for the breach of the Ukrainian system, though this claim has not been independently verified.

Ukrainian officials responded to the incident by clarifying the nature of the alerts:

• The Ukrainian Air Force stated, "The Air Alert app appears to have been subjected to hostile interference. There is no radiation threat!"
• Yurii Ihnat, a spokesman for the Ukrainian Air Force, said the hack had no impact on Ukraine's security operations and noted the app is not affiliated with military command systems.
• The app's developers stated that "unauthorized parties" had interfered with the operation, leading to a temporary suspension of the service.

In Russia, the Emergencies Ministry stated it had identified the digital vulnerability exploited by the attackers and was taking steps to prevent future breaches. Kremlin spokesperson Dmitry Peskov stated that Russian government agencies face constant cyber threats, including those involving artificial intelligence, and noted that "all government bodies must take steps to improve the cybersecurity of our digital resources."

Context of the attacks

The cyberattacks occurred as a localized humanitarian ceasefire in the southern Ukrainian region of Kherson was expiring. The truce, which began on October 27, was brokered with the involvement of U.S. first lady Melania Trump and Pope Leo XIV. The ceasefire allowed for humanitarian aid and the evacuation of residents from the occupied town of Oleshky.

While the false alerts caused alarm for some, many residents in Kyiv reported they did not panic, with some noting the messages were written in Russian or contained spelling errors. The Ukrainian Center for Strategic Communications attributed the incident to Russia, while Russian authorities did not name a specific suspect.

Sources

• theguardian.com: Hackers send fake nuclear threat alert to Ukraine emergency app | Ukraine | The Guardian
• cbsnews.com: Ukraine and Russia's emergency alert apps both hacked, residents warned of fake nuclear, chemical strikes - CBS News
• nbcnews.com: Ukraine, Russia report emergency app cyberattacks as fake alerts warn of nuclear danger
• newscord.org: Russia And Ukraine Hack Emergency Alert Apps, Spread Fake Nuclear And Radiation Warnings: who 27 outlets blamed | NewsCord
• timesofindia.indiatimes.com: ‘Oreshnik is incoming’: Hackers send fake nuclear warning through Ukraine alert app - The Times of India
• aroundprague.cz: Hackers Send False Nuclear Alerts Through Ukrainian and Russian Emergency Apps

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.