Hackers hijacked Ukraine's and Russia's alert apps to send fake nuclear warnings

Hackers took over the official alert apps of Ukraine and Russia within hours of each other on November 1-2 and used them to push fake warnings about radiation, chemical attacks and nuclear strikes. In Ukraine the target was "Air Alert" (Povitryana Tryvoha), the app people use to know when to go to a shelter. In Russia it was the mobile app of the Emergencies Ministry. Both governments say their sirens and main warning systems kept working, and nobody has shown that the two attacks are linked.

Ukraine: radiation, chemicals and street fighting in Kyiv

On Sunday evening users in Kyiv got push alerts reading "There is a radiation hazard alert in Kyiv. Do not go outside!" and "There is a chemical attack alert in Kyiv. Do not go outside!", Fox News reported. Other notifications warned of street fighting in the capital and, in Russian, of a nuclear threat from the Oreshnik missile. The app's online map showed Kyiv and other regions under a nuclear alert.

The Ukrainian Air Force wrote on Telegram that the app "appears to have been subjected to enemy influence" and that there was no radiation threat. Its spokesman Yurii Ihnat said Russians had attacked the app overnight and that the Defence Forces were not affected, RBC-Ukraine reported. He noted that the app does not belong to the Air Force and is only an additional alert channel. A Russian hacker group called Hitcore claimed responsibility and said it got in by sending an administrator a malicious file disguised as an explicit photo. That account comes only from the hackers, as relayed by Lenta.ru, and Ukrainian officials have not confirmed how the attackers got in.

The app team confirmed "unauthorised interference", switched off push notifications and suspended the service, Ukrainska Pravda wrote. The team said the app stores no personal data, so no user data leaked, and asked people not to click links in suspicious notifications. By about 2 a.m. alerts and the map were partly back, but the display of incoming targets stayed off.

Russia: fake nuclear launch messages in 33 regions

A few hours later, overnight on November 2, Russia's Emergencies Ministry announced that its mobile app "has been subjected to a massive cyberattack" that let attackers send false information to the public, Interfax reported. At about 2:45 a.m. Moscow time, messages about a supposed launch of nuclear warheads at Russia appeared at once in the app and in the Telegram channels of the ministry and regional emergency headquarters, Lenta.ru reported, citing the Telegram channel "Ostorozhno, Novosti".

The ministry later said users in 33 regions received a false message. It says it spotted the incident when the first messages went out, disconnected and isolated the services, and would fully restore the app by the end of the day, according to Interfax. Sirens, SMS alerts and TV and radio broadcasts were not affected, the ministry added. It has not said who was behind the attack.

How to tell a real alert from a fake one

A hacked official app is harder to spot than a phishing text: the warning arrives from an app you trust, with its usual sound and design. Ukraine's Ministry of Digital Transformation used the incident to remind people of the backup channels, Ukrainska Pravda reported. The advice works in any country:

• Turn on the phone's built-in emergency alerts: on iPhone, Settings, Notifications, then "Government Alerts" at the bottom of the list; on Android, search the settings for "Wireless emergency alerts" or "Emergency alerts", as the name varies by brand. These come from the mobile network, not from an app, and sound even in silent mode.
• Check with a second official source: sirens, the Air Force or civil defence channels, local authorities. A real nuclear or chemical warning would not appear in only one app.
• Do not tap links in alerts: genuine warnings tell you what to do, they do not ask you to open a website, install anything or enter data.
• Keep more than one alert app: in Kyiv, the Kyiv Digital app kept showing alerts normally while Air Alert was down.