Russia and Ukraine Emergency Alert Apps Compromised, Broadcasting False Missile and Nuclear Strike Warnings
Cyberattacks simultaneously targeted and compromised the emergency alert applications of both Russia and Ukraine, broadcasting fabricated messages about missile and nuclear strikes to citizens.
In a coordinated cyberattack, the emergency alert applications of both Russia and Ukraine were compromised on Sunday evening, disseminating false warnings of missile and nuclear strikes to the public. Officials from both nations confirmed the incidents, which occurred within hours of each other, and worked to dispel the fabricated alarms.
Ukraine's "Air Alert" application was reportedly the first to be affected. Around 2100 UTC, the Ukrainian Air Force issued a statement via Telegram assuring citizens that there was no radiation threat and urging them to remain calm, indicating the app had likely been compromised. The fake messages sent to Ukrainian devices reportedly included warnings of street fights in Kyiv, chemical attacks, and radiation hazards. Notably, one of the earliest false alerts, written in Russian and referencing an "Oreshnik" missile, was quickly identified as inauthentic.
Several hours later, around 0030 UTC on Monday, Russia's Ministry of Emergency Situations confirmed a similar attack on its own mobile application. The ministry stated that attackers had exploited a vulnerability to send fake information to citizens, warning of impending nuclear strikes across "all regions of Russia" and referencing a Ukrainian attack drone named "P1-Sun." The ministry assured the public that work was underway to fix the vulnerability and restore normal operations.
Both governments emphasized that their primary national alert systems remained secure and unaffected by the app compromises. Russia's Ministry of Emergency Situations clarified that the mobile app was merely an additional, supporting service, with official alerts disseminated through primary channels such as regional and municipal alert systems, SMS messaging, and broadcast media. Similarly, Ukraine's Ministry of Digital Affairs reminded citizens of alternative official channels for emergency warnings, including iOS and Android emergency alerts, sirens, and government social media accounts.
While Russia has not officially attributed the attack on its app to any specific actor, Oleksander Merezhko, chairman of the Ukrainian parliament's foreign affairs committee, suggested the attack was almost certainly part of Russia's ongoing cyber warfare efforts. He noted the suspicious Russian-language alert as a potential indicator. The timing of Ukraine's announcement coincided with the official end of a six-day ceasefire in Kherson, a Russian-occupied city, adding a layer of geopolitical tension to the cyber incidents.
Officials in both countries worked swiftly to restore functionality and reassure the public. Russia's Ministry of Emergency Situations announced approximately 90 minutes after the initial confirmation that its app was functioning normally. The incidents highlight the vulnerability of public communication channels during times of conflict and the potential for misinformation campaigns to sow panic and distrust, even when official warning systems remain intact.
The new article provides further details on the actors involved, identifying a Russian-linked group named Hitcore Corp as a likely perpetrator behind the compromise of Ukraine's Air Alert app. It also notes that the Ukrainian group DC8044 claimed responsibility for a retaliatory attack on Russia's EMERCOM app. Both app developers have since taken steps to restore service and enhance security measures.