Hackers have hijacked emergency warning apps on both sides of the Russia-Ukraine war, using them to push false alerts of nuclear, chemical and street combat threats to civilians within hours of a temporary ceasefire coming to an end.
Ukraine’s air force said on Sunday (1 November) that its public air raid alert app, which is used nationwide to warn people in real time of incoming Russian air attacks, had been compromised. For a short time, the app displayed warnings that Kyiv and other areas faced nuclear, chemical and street combat threats, with one message claiming that Russia’s Oreshnik hypersonic missile had been deployed.
“The air alert app appears to have been subjected to enemy influence,” the air force said on Telegram, adding: “There is no radiation threat! Stay calm and follow our updates on our channel!” Air force spokesperson Yuriy Ignat later confirmed to AFP that the app had been hacked.
Ukraine’s Centre for Strategic Communications (SPRAVDI) blamed Russia for the attack, while the Centre for Countering Disinformation said the threat-level information shown in the app “does not correspond to reality”. The country’s digital transformation ministry said the app was not operating, but that other alert methods, including air raid sirens, were still working. A separate alert app run by Kyiv’s city authorities was unaffected.
“We are seeing emergency alert apps targeted specifically to induce civilian panic and confusion,” said Dray Agha, senior manager, tactical response at Huntress. “These mobile applications are highly visible targets for attackers.”
Hours later, early on Monday (2 November), Russia’s Emergencies Ministry said its own mobile warning app, which alerts the public to incoming drone attacks and other threats, had suffered a “massive cyberattack” that allowed attackers to send “false information” to the public. The ministry said its teams were working to restore the service but did not say who it believed was responsible, and it is not yet clear whether the two incidents are linked.
Both attacks coincided with the end of a localised truce in Ukraine’s Kherson region. The ceasefire, which ran from 27 October to 1 November, was the longest of the war so far, and Kyiv said Moscow had refused an offer to extend it.
Jamie Akhtar, CEO and co-founder of CyberSmart, said: “The reported cyberattacks on emergency alert apps in Ukraine and Russia are a concerning reminder that cyber threats can have consequences far beyond financial losses or stolen data. In Ukraine, hackers reportedly compromised an air raid warning app, sending false alerts about nuclear and chemical threats, while Russia’s emergency ministry also reported a cyberattack that allowed false information to be distributed. Although it’s not yet clear whether the incidents are connected, the implications are extremely serious.”
“These systems are designed to protect lives, and compromising them risks causing widespread panic, spreading misinformation and undermining public trust in critical safety infrastructure. In a conflict where people rely on accurate warnings to seek shelter, the consequences of a genuine alert being ignored could be devastating.”
‘Mutually Assured Deception’
Don Smith, vice president, threat intelligence at the Sophos Counter Threat Unit, said the Ukrainian incident should be seen as part of a wider information war. “Disinformation is as much a part of war as bombs and bullets, targeted information attacks could aim to impact the mental resilience of the people of Ukraine. Their resilience is a key part of their ability to defend against the Russian military,” he said.
“Usually the best information warfare is not obvious or explicit, where this very clearly is. It could indicate desperation from Russia.”
Smith added that the near-simultaneous attack on Russia’s own app could reflect a tit-for-tat dynamic. “Mutually Assured Destruction is a doctrine used relating to nuclear war. If, as we assume, the Russian incident was a response to the Ukraine incident, Russia might consider that Mutually Assured Deception is at play.”
Spencer Starkey, executive VP EMEA at SonicWall, said: “Cyber attacks have become a defining feature of modern warfare. Rather than relying solely on conventional military action, states and state-aligned groups increasingly use cyber operations to disrupt economies, undermine public confidence and apply pressure.”
How were the apps compromised?
Neither government has yet explained how the attackers gained access. Smith said the answer may lie in the systems that sit around the core warning infrastructure, rather than the infrastructure itself.
“Whilst investigating a cyber attack against a TV channel some years ago, it was unclear what the motivation might be. We concluded that whilst it would be very difficult to disrupt the actual broadcast channels, the systems which supported the ‘banners’ under news items were pure IT systems and could actually be easily targeted,” he explained. “These early warning systems will operate in a similar way to allow for broadcasts to be submitted. It is possible that the account of an individual with access to submit broadcasts was compromised rather than the core system itself.”
Starkey pointed to the familiar weaknesses that state-aligned attackers tend to exploit. “By exploiting common weaknesses such as unpatched systems, weak access controls or vulnerable third-party software, attackers can deploy ransomware, data-theft campaigns or destructive malware capable of halting operations at scale.”
Graeme Stewart, head of public sector at Check Point, said the incidents should prompt scrutiny of warning systems elsewhere, including in the UK. “The UK’s system operates differently from the apps reportedly hacked in Ukraine and Russia, but the incidents raise serious questions about cybersecurity, particularly around who can access emergency warning systems, how alerts are authenticated and whether a compromised supplier could provide a way in.”
Could it happen here?
“The prospect of hackers being able to send fake nuclear or chemical attack warnings to millions of people is frightening, particularly when you consider how quickly fear can spread,” Stewart said.
“In Britain, we’ve only experienced the national Emergency Alerts system a handful of times, and there’s still a novelty around it. Every time those alarms sound, social media lights up with people sharing screenshots, questioning what’s happening and speculating about why they’ve received one. Imagine that happening with a warning of an imminent nuclear attack, particularly in the middle of the night when people are frightened and struggling to verify what’s happening. Even if authorities corrected it within minutes, the damage could already have been done.”
He warned that generative AI could amplify the impact of any false alert. “AI makes this more concerning because attackers could quickly flood social media with convincing fake footage, fabricated news reports and cloned voices of officials apparently confirming the threat. A single false alert could become the spark for a much wider misinformation crisis, with people making potentially dangerous decisions based on what they believe is happening.”
Sirens still matter
Ukraine’s reassurance that sirens were still operating while the app was offline underlines a key point for defenders: apps are only one layer of a national warning system.
“Both nations rightly emphasise that apps are only supplementary to physical infrastructure like sirens and radio broadcasts,” said Agha. “A resilient national warning system must always rely on multiple independent communication channels so the public can verify threats.”
Stewart agreed. “Authorities need to be able to correct false warnings immediately, using trusted channels that remain operational during a cyber-attack. The public also needs to understand how to verify an alert, particularly as criminals could imitate official warnings without ever gaining access to the genuine system.”
Akhtar said the lessons apply well beyond Ukraine and Russia. “For countries and organisations alike who are responsible for critical systems, this highlights the importance of ensuring cybersecurity is treated as a fundamental part of public safety. Strong access controls, multi-factor authentication, regular security assessments and continuous monitoring are essential for preventing unauthorised access. Equally important is having reliable backup communication channels and robust incident response plans to ensure essential services can continue operating during an attack.”
Stewart added: “Perhaps the greatest long-term concern is what repeated incidents would do to public confidence. If people begin questioning whether an emergency warning is genuine, precious minutes could be lost when a real threat emerges.”
Akhtar concluded: “Ultimately, this incident demonstrates that when critical infrastructure is targeted, people’s safety and potentially their lives can be at risk and therefore should be treated with the utmost importance.”
