Hackers Target Ukraine and Russia With Fake Nuclear Attack Warnings

Cyberattacks targeting emergency warning applications in Ukraine and Russia sent false nuclear, chemical, and radiation alerts to millions of smartphone users over the weekend, raising concerns about the vulnerability of civilian warning systems during wartime.

The incidents occurred hours apart on Nov. 1 and 2, with hackers exploiting applications designed to protect civilians from military attacks. Authorities in both countries confirmed the breaches, although investigators have not established whether the attacks were connected.

Ukraine’s emergency alert system compromised

Residents of Kyiv and other Ukrainian cities began receiving alarming notifications shortly before 11 p.m. on Sunday, Nov. 1, warning of radioactive contamination, chemical attacks, and street fighting.

According to Reuters, the messages originated from Ukraine’s widely used Air Alert application, which millions of residents rely on for warnings about incoming Russian missiles and drones. One notification falsely claimed that Russia had launched an Oreshnik ballistic missile, a weapon capable of carrying a nuclear warhead.

Another message, written in Russian, announced: “There will be a nuclear threat across Ukraine. Do not worry, the Oreshnik is incoming.”

For the best of our weekly content！

You are now signed up for our newsletter

Check your email to complete sign up

Ukraine’s Air Force quickly intervened, warning that the system appeared to have been compromised.

“There is no radiation threat!” the Air Force declared, urging residents to disregard the notifications and follow verified military communications.

The application’s developers subsequently confirmed that unauthorized individuals had interfered with its operation. Push notifications were temporarily disabled while technical teams investigated the breach.

Cybersecurity publication The Record reported that some fraudulent notifications closely resembled legitimate emergency warnings, including the familiar automated voice used by the application.

A previously unknown hacking group calling itself Hitcore claimed responsibility for the intrusion. However, independent investigators have not verified the group’s involvement or established its affiliations.

Despite the disruption, Ukrainian authorities emphasized that the country’s broader emergency infrastructure remained operational. Air raid sirens, official military communication channels, and other public warning systems continued functioning.

Ukraine’s Air Force spokesperson Yurii Ihnat also confirmed that the breach had not affected military command or defense operations.

Russia’s emergency warning system targeted hours later

Just hours after the Ukrainian incident, hackers struck Russia’s Ministry of Emergency Situations mobile application, distributing fraudulent warnings about incoming nuclear weapons.

According to an Associated Press report, the attack occurred at approximately 2:45 a.m. Moscow time on Nov. 2, with false notifications reaching users across 33 of Russia’s 89 regions.

The messages falsely claimed that nuclear warheads had been launched against Russian territory and instructed citizens to stockpile three weeks of food and seek shelter in basements.

Russia’s Emergency Situations Ministry acknowledged the intrusion but emphasized that the country’s primary emergency infrastructure remained functional.

“The hacking of the mobile app has not affected and cannot affect the operation of the public warning system,” the ministry said in an official statement.

The ministry explained that emergency notifications continued through traditional channels, including sirens, loudspeakers, text messages, television, and radio broadcasts. The compromised mobile application served only as a supplementary warning service.

“We ask the public to remain calm and to trust only official sources of information,” the ministry added, according to Reuters.

Cybersecurity publication The Record reported that a Kyiv-based hacking collective calling itself DC8044 claimed responsibility for the Russian breach. The group alleged that it exploited an application programming interface (API) to gain access to the warning system.

The claims remain independently unverified, and neither government has established a confirmed connection between the two attacks.

The incidents highlight a growing vulnerability in modern emergency communication systems. While digital warning applications provide rapid, potentially life-saving information, compromising those same systems allows attackers to distribute fabricated threats through channels that civilians have been trained to trust.