False nuclear alerts sent through Ukrainian and Russian emergency apps

False nuclear and chemical alerts were sent through Ukraine’s Air Alarm app late on Sunday 1 November, and a false nuclear alert went out through Russia’s Emercom app a few hours later. Both governments acknowledged the incidents, which forced them to correct a trusted public safety channel while leaving the attackers’ identity and the technical cause unresolved.

KBS, citing Reuters and AP, reported that Ukraine’s national air-raid app sent false messages around 11pm local time warning of nuclear and chemical attack, and that some regions were also warned of street fighting. The BBC, which identified the app as Air Alarm, reported red-level warnings across the country and said some of the fake messages were written in Russian. One included a link to a Telegram channel apparently owned by a hacker group.

Within 15 minutes, Ukraine’s Air Force said the app had been compromised and that there was no radiation threat. All-clear messages took more than an hour, the BBC reported.

Russia’s Emergency Situations Ministry said hackers sent a false alert through its app at about 2.45am Moscow time on Monday across 33 of Russia’s 89 regions. The message claimed that nuclear warheads mounted on P1-Sun attack drones had been launched across all Russian regions. The ministry described a massive cyberattack, said specialists had identified the vulnerability exploited and said necessary measures were being taken. It did not name a suspected actor.

Shutdown and restoration

Ukraine’s government said it had temporarily disabled the Air Alarm app for maintenance after describing it as apparently compromised. The Air Force urged people to use other official channels. AP reported that the air raid alert channel warned users not to click links in suspicious notifications, and that the state-run Center for Countering Disinformation urged people to monitor other emergency channels.

On Monday, Stepan Tanasiychuk, who leads Ukraine’s Air Raid Alert project, said the app was gradually being restored, with new yellow and red alert levels available, and that the team was taking additional security measures. The measures were not described or independently assessed.

Russia’s emergencies ministry said the Emercom app was operational and full functionality would be restored by the end of the day. It said the hack had not affected the wider alert system, and that alerts continued through SMS, media broadcasts, municipal sirens and loudspeakers. AP reported that restoration efforts were described as ongoing, a difference that may reflect timing.

Attribution remains open

The BBC and CNN reported that it was unclear who was behind the cyberattacks or whether the incidents were connected. AP reported that a Russian Telegram channel with links to Russia’s security services relayed a claim by a group called Hitcore that the group was responsible for the compromise of the Ukrainian system. AP said it had not verified the claim, and that the identities, affiliations and motivations of the purported hackers remained unclear.

Yevhen Baliutov, a cybersecurity expert at Kyiv School of Economics, told the BBC that it was clear to him that Russians had hacked the Ukrainian system. He said many Ukrainians had clicked a link to a Russian Telegram channel, potentially exposing them to disinformation, phishing or data breaches. That is one expert’s assessment; the reporting does not establish how many clicked or that harm followed.

The BBC also noted that the informal language in the hoax alerts pointed to hacktivist groups that could be aligned to Moscow or Kyiv but were not formally directed by either government. Baliutov suggested that a Ukrainian cyber-response against the Russian system was logical. No forensic evidence linking the two episodes has been reported, and timing alone cannot establish common authorship.

Trust and warning fatigue

The BBC reported that many people in Ukraine did not take the fake warnings seriously and doubted them. CNN reported that the messages appeared to have little impact, generated memes and prompted some users to say their trust in official warnings had been undermined. These are qualitative observations, not measured findings.

Oleksander Merezhko, chair of the foreign affairs committee in Ukraine’s parliament, told the BBC that the attack did not cause panic and that the Russian-language message aroused suspicion. The BBC also reported that the authorities faced the challenge of maintaining public alertness after four and a half years of war, with warnings sometimes sounding hourly, and now had to reassure people that the systems protecting them were robust and trustworthy.

That is the trust problem. A mass notification system depends on people believing it. The reporting does not quantify the effect of the false alerts, but it shows the pressure on officials to keep people taking warnings seriously while acknowledging that the alert channel had been abused.

What the evidence does not establish

The BBC reported that a number of apps deliver air-raid notifications using the same data as the official government-backed app. The reporting does not establish that other apps displayed the fake messages, so the scope established here is the Air Alarm application and the Russian Emercom app. No affected versions, patch identifiers or CVE records have been reported.

The term hacked reflects official accounts and reporting, not an independent technical finding. No data access or exfiltration has been established, and no harm from the Telegram link has been confirmed. Russia’s claim to have identified the exploited vulnerability is a government statement, and neither app’s current security has been independently assessed.

Both governments have acknowledged that false alerts were sent. The open questions are who sent them, whether the two episodes were connected, how the false messages entered the apps and whether the restoration and additional measures have closed the gap.

The documented sequence supports one limited conclusion. A false alert in an emergency app is a trust problem as well as a security problem. The apps concentrate public reliance on a single channel, so a false message required both governments to restore service, correct the record and persuade the public that the next alert should be trusted. The reporting shows that work is still under way, with the technical cause of either incident unknown.

An alert appears in a government app that millions of people have learned to trust. What would it take to tell whether that message really came from the authority it named? The gap between delivery and origin is where networking study earns its keep: tracing how a message moves between systems, what each stage of that journey can confirm, and why arriving on a phone says nothing about who sent it. Russia says it identified the exploited weakness and Ukraine says it is adding security measures, while the reporting leaves both the cause and the sufficiency of those steps open. Readers who want to weigh such claims rather than accept them can explore The Hack Academy’s online cybersecurity training programme, which includes networking among its listed subject areas, with self-paced learning and practical exercises alongside the theory.