Security News Hackers Hijack Emergency Alert Apps in Ukraine and Russia to Send Fake Nuclear Attack Warnings

[Brownie2019]

Content source

https://cybersecuritynews.com/hackers-hijack-emergency-alert-apps/

Hackers targeted emergency alert apps in Ukraine and Russia late on November 1 and into November 2, sending false warnings about radiation, chemical threats, and nuclear strikes.

The incidents disrupted trusted public safety channels during wartime. However, officials said the app breaches did not disable their wider warning systems. No independent report has linked either attack to a named hacking group.

Ukraine’s Air Alert app began sending false notifications late Sunday, including warnings of dangerous radiation levels in Kyiv. Other messages claimed chemical threats and street fighting.

Some appeared in English with spelling and grammar errors. In contrast, others mixed Russian and Ukrainian, according to Associated Press reporting published by ITV News.
Hackers Hijack Emergency Alert Apps

Ukraine’s Air Force told residents there was no radiation threat. The app’s operators said unauthorized parties had interfered with the service, prompting them to turn off push notifications and temporarily suspend operations. Officials warned users not to open links in suspicious notifications and directed them toward other official information channels.

The app, developed through cooperation between Ukraine’s Digital Transformation Ministry and security company Ajax Systems, delivers warnings that help civilians seek shelter.
Officials said service was restored overnight. Air Force spokesman Yurii Ihnat stressed that the breach did not affect military operations because the app is separate from military command systems.

Hours later, Russia’s Emergencies Ministry reported a “massive cyberattack” against its mobile application. Attackers used the access to distribute false public warnings.

The Kyiv Independent reported that messages claimed nuclear warheads had been launched across Russia and urged people to shelter in basements and gather food for three weeks.

According to Euronews, Russian officials are working to fix the vulnerability and restore app services, while confirming that other warning channels, including SMS, broadcasts, sirens and loudspeakers, remain operational. The ministry did not identify the attackers.

Public reports establish that attackers could send unauthorized messages, but they do not explain how they gained access. The cited reporting disclosed no confirmed entry point, affected software version, or vulnerability identifier. Claims involving stolen passwords, malware or a specific software flaw would therefore be premature.

Ukraine’s Center for Strategic Communications blamed Russia for the Ukrainian incident, but that claim has not been independently confirmed. The close timing also does not prove the Russian app breach was retaliation or that both attacks shared an operator.

The incidents follow earlier threats to Ukrainian services. Cybersecurity News previously covered Russian hackers inside Kyivstar’s network and charges against six Russian nationals over attacks on Ukrainian government networks. Neither report establishes a connection to these app breaches.

For residents, the immediate concern was trust in urgent warnings. Ukrainian authorities urged people to monitor official emergency channels and physical alerts while recovery continued. The response underscored the importance of maintaining multiple ways to deliver life-saving information when one digital service is compromised.

 

[Bot]

Hi Brownie. The important technical distinction is that unauthorized messages were distributed through legitimate alert apps; that does not yet show that the mobile app binaries, app stores, or recipients’ phones were compromised. “App hacked” is reasonable headline shorthand, but not a forensic description.

The public evidence establishes an integrity failure somewhere in the publishing chain. Possible causes include a compromised operator account, exposed backend API, or stolen push credentials, but those remain hypotheses until the operators publish technical findings. The developers reportedly disabled push notifications and temporarily suspended Ukraine’s app after detecting the interference, while the BBC reports that neither government confirmed who was responsible. The close timing is interesting, not attribution wearing a clever hat.

Arguably, the worst consequence is not the brief outage but loss of trust. A forged warning arrives with the legitimate app’s name and icon, exactly where people have been trained to expect life-saving instructions. False alarms can cause immediate panic and, over time, alert fatigue that makes the next genuine warning easier to dismiss. Maintaining sirens, SMS, radio and other independent channels was therefore essential rather than merely convenient.

For residents, the sensible response is:

• Don’t dismiss an extreme alert solely because its wording looks strange. If the danger could be imminent, shelter while checking other official channels.
• Compare it with sirens, SMS, broadcasters and verified local-authority announcements.
• Don’t open links embedded in suspicious notifications.
• Remember that merely receiving the notification is not evidence that the phone is infected.
• Once authorities confirm restoration, keep the official app updated rather than permanently disabling an important warning channel.

For operators, the alert-publishing console deserves controls comparable to those protecting critical infrastructure: phishing-resistant MFA, tightly scoped accounts, rapidly revocable credentials, separate emergency shutdown access, immutable logging and dual authorization for exceptional categories such as nuclear or chemical warnings. A single credential should not be able to shout “nuclear strike” to an entire country without a second pair of eyes.

Sources

• Fake nuclear warnings issued after Ukrainian and Russian air alert apps hacked - BBC News

 

[Morro]

This was a truly sick and extremely dangerous thing to do. What if some nutcase would have given orders to launch... shjees!

 

[Halp2001]

What makes cases like this concerning is not just the false alert itself, but the damage they can cause to trust in official channels. Today, an attack doesn't even need to take systems down to cause problems; sometimes, all it takes is sowing doubt and confusion in a tool that millions of people rely on. The risk is that when a real alert comes, some people may no longer take it seriously.