When the Warning App Becomes the Attack Surface: False Alerts Hit Ukraine and Russia

The first false warnings appeared in Ukraine’s Air Alert app

The Ukrainian incident unfolded during a war in which phone alerts are part of everyday civilian risk management. The Air Alert app is used to notify people about incoming missile and drone threats and other hazards. On the night of November 1, users instead received false warnings about radiation, chemical danger and street fighting. A message in Russian referred to a supposed Oreshnik strike and included a link to an outside Telegram channel.

Ukraine’s Air Force urged people to stay calm and said there was no radiation threat. The State Emergency Service’s regional rescue centre repeated that the app’s threat information was not reliable at that moment and warned users not to follow outside links. The app’s developers then said unauthorized interference had occurred, disabled push notifications and temporarily suspended the service.

Sources: Air Force warning that the Air Alert app had likely come under hostile influence · Air Alert developers’ incident statements and technical explanation · Air Alert app likely affected by a cyberattack · Hackers hit Ukraine and Russia's emergency apps, send fake nuclear alerts · Ukraine and Russia both report cyberattacks on emergency apps · Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings

The Ukrainian developers say the access point was an operator interface

The developers’ later explanation adds an important technical distinction. They said the intrusion was not into the consumer app installed on people’s phones. Instead, unauthorized access was gained to the operator interface used to manage the alert service, allowing non-existent alerts to be entered into the system. The developers did not disclose the full technical details, citing security concerns.

They describe Air Alert as a broader software ecosystem built by Ajax Systems and Stfalcon with support from Ukraine’s Ministry of Digital Transformation. It includes an operator interface, mobile apps, an alert map and an API. Information supplied by civil-protection operators or responsible local authorities is displayed in the app and passed to other services. The developers say those integrations can include alert maps, loudspeakers in shopping centres and some street-warning sirens. That architecture means the incident should not be reduced to a simple case of malware on individual phones.

The developers said they suspended the operator interface and server-side service, checked and addressed the immediate cause, and restored the operator interface and core app functions within about two hours. Push alerts and basic threat levels returned, while the display of targets on the map remained temporarily disabled as a security audit continued. They also said the app does not store or transmit users’ personal data and denied reports of compromised user accounts or phones. Those are the developers’ statements; the public material reviewed here does not include an independent forensic audit.

Sources: Air Alert developers’ incident statements and technical explanation · Air Alert app launched with support from the Ministry of Digital Transformation · Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings

Russia confirmed a separate attack on its ministry’s mobile app

Russia’s Ministry of Emergency Situations said an attack on the administration panel of its mobile app took place on November 2. At about 2:45 a.m. Moscow time, a false message was sent in 33 federal subjects. The ministry said specialists detected the incident when the first false notifications appeared, disconnected and isolated the affected services, and began removing false information from regional emergency-response channels on the MAX messenger.

Reuters and the Associated Press reported that the fabricated message claimed nuclear warheads had been launched against Russian regions and urged people to stock food and shelter in basements. The ministry did not publish the full technical details, but said it had identified a vulnerability exploited by the attacker and sent information about the incident to Russia’s National Coordination Center for Computer Incidents. It said the app was functioning again and that full restoration was expected by the end of the day.

Sources: Measures are being taken to prevent cyberattacks and restore the normal operation of Russia’s EMERCOM services · Hackers hit Ukraine and Russia's emergency apps, send fake nuclear alerts · Ukraine and Russia both report cyberattacks on emergency apps · Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings

Two attacks do not prove a single cyber operation

The timing invites a story of digital retaliation: a Ukrainian service is compromised, then a Russian service is hit hours later. But sequence is not attribution. Ukraine’s Air Force described its app as likely subjected to hostile influence. Russia’s ministry acknowledged an attack but did not identify the perpetrator. Neither public statement supplies evidence that the two intrusions shared an operator, infrastructure or plan.

That picture changed on November 2, when President Volodymyr Zelenskyy told PBS NewsHour that Russia had attacked Ukraine’s alert system and that Ukraine had hacked Russia’s app in response. “We only respond to their attacks,” he said, adding that Ukrainian intelligence had confirmed Russia was behind the attack on Ukrainian civilians. He did not say which Ukrainian unit carried out the operation, and Russia has not confirmed his account. No independent forensic evidence has been published attributing either intrusion.

Groups using the names Hitcore Corp and DC8044 claimed involvement in the Ukrainian and Russian incidents respectively, according to Recorded Future News. Other pro-Ukrainian accounts also circulated material about the Russian app. These are claims by online groups, not independently verified attribution. Reuters said it could not verify which groups were responsible. The hacker-group claims therefore remain unverified as attribution. Zelenskyy’s account is the only on-the-record link between the two incidents — a presidential claim, not an independent forensic finding — and it describes retaliation, not a coordinated joint operation.

The attacks also occurred around the expiry of a six-day local ceasefire in southern Ukraine. That timing was reported by Reuters and the Associated Press, but none of the sources reviewed establishes a causal connection between the ceasefire and either intrusion.

Sources: Air Force warning that the Air Alert app had likely come under hostile influence · Measures are being taken to prevent cyberattacks and restore the normal operation of Russia’s EMERCOM services · Hackers hit Ukraine and Russia's emergency apps, send fake nuclear alerts · Ukraine and Russia both report cyberattacks on emergency apps · Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings · ‘We only respond’: Zelensky confirms Ukraine hacked Russia air raid app in retaliation

The apps were not the same thing as national warning systems

Both governments said the incidents did not disable their main public-warning channels. Ukraine’s State Emergency Service said the national warning system was operating normally and that threat signals continued to pass to regional administrations and street-warning systems. Russia’s ministry said its core channels included regional and municipal sirens, loudspeakers, SMS, television and radio, and described its mobile app as an additional information service.

That distinction matters, but it should not be used to dismiss the breach. The Ukrainian developers describe an ecosystem with APIs and external integrations, while the State Emergency Service said the national system remained operational. The public statements do not specify whether any individual downstream integration received or acted on false data. There is no public evidence in the reviewed sources that nationwide sirens were triggered by the fabricated app alerts; equally, the full scope of every connected service has not been independently documented.

The Ukrainian app itself was launched in 2022 by Ajax Systems at the initiative of Stfalcon, with support from the Ministry of Digital Transformation. Its official launch notice described it as one tool for receiving the start and end of air-raid alerts, alongside other external warnings. That institutional context helps explain why a compromise of the service could be serious without amounting to a collapse of the state’s entire warning network.

Sources: Air Alert developers’ incident statements and technical explanation · Official statement on the operation of Ukraine’s warning systems · Measures are being taken to prevent cyberattacks and restore the normal operation of Russia’s EMERCOM services · Air Alert app launched with support from the Ministry of Digital Transformation · Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings

The lasting risk is damage to trust in a channel people rely on

An emergency alert is useful only if people can judge whether it is authentic and act on it in time. False warnings can create immediate confusion, encourage users to follow malicious links or make people more hesitant when a genuine warning arrives later. These are risks inherent in the incident, not evidence that a broad public panic or a measurable change in civilian behaviour occurred.

The response challenge is therefore wider than restoring an app store download or restarting push notifications. It includes protecting the systems that authorize alerts, limiting who can create or distribute them, keeping auditable records of changes, and ensuring that critical warnings can be checked through independent channels. Those are general resilience principles, not a description of controls that either government has confirmed implementing after these incidents.

The clearest conclusion is also the narrowest. False emergency messages were injected into mobile alert services in Ukraine and Russia; both countries said their primary public-warning channels continued to operate. The attacks did not prove that national alert systems had collapsed. Independent evidence has not established who was behind both incidents, although President Zelenskyy publicly attributed the Ukrainian-app attack to Russia and confirmed a retaliatory Ukrainian operation against the Russian app. They did show that the trusted digital layer between an official warning and a civilian’s phone can itself become a target.

Sources: Air Force warning that the Air Alert app had likely come under hostile influence · Air Alert developers’ incident statements and technical explanation · Air Alert app likely affected by a cyberattack · Official statement on the operation of Ukraine’s warning systems · Measures are being taken to prevent cyberattacks and restore the normal operation of Russia’s EMERCOM services · Hackers hit Ukraine and Russia's emergency apps, send fake nuclear alerts · Ukraine and Russia both report cyberattacks on emergency apps · Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings · ‘We only respond’: Zelensky confirms Ukraine hacked Russia air raid app in retaliation