Air Alert app (Ukraine) hacked to push fake nuclear and chemical alerts; Russian EMERCOM app also attacked
Severity: medium · Patch status: unknown · Since 2026-11-01
On Sunday 1 November 2026, late in the evening, users of Ukraine's Air Alert app received push alerts, in the voice the app normally uses for real warnings, that falsely reported a possible Oreshnik nuclear-capable missile strike, radiation and chemical hazards, and street fighting in Kyiv. One of the earliest messages was in Russian, and one message linked to a Telegram channel of a previously unknown group calling itself Hitcore Corp, which claimed the breach. Ukraine's Air Force said around 21:00 UTC that the app had likely been compromised by the enemy and told residents to disregard the messages. The app's developers, identified by The Record as Ajax Systems, said unauthorised people had interfered with the app's operation, turned off push notifications, suspended the service and said it stores no personal data. By early Monday push notifications and basic threat indicators were back, the map display was still off, and extra security measures were promised. The app had 6.6 million active users as of January 2026, per The Record. Hours later a self-described Kyiv-based group, DC8044, claimed it had breached Russia's EMERCOM emergency app through its API and used it to send false nuclear-launch warnings. Around 00:30 UTC on Monday EMERCOM confirmed a massive cyberattack that let attackers send fake information to the public, said it was patching a vulnerability, and later said the app was working normally again. It stressed that the attack could not affect the public warning system, which still runs on sirens, SMS, TV and radio. No source says how either app was entered, and neither group's identity or the DC8044 claim has been independently verified. Russia has not blamed Ukraine by name. Precedents are the 2023 hijacks of Russian radio broadcasts and the 2023 AnonGhost abuse of Israel's Red Alert app. Treat in-app alerts as unverified until sirens, SMS, TV or radio confirm them.
What to do
- Treat in-app and push alerts as unverified until corroborated by sirens, SMS, TV or radio; tell users to disregard unverified alerts and not to open links in them, as the Ukrainian Air Force and the app's developers did
- For operators of alert apps: require authentication on push and API paths, sign notification payloads, check server-side that each sender and region is authorised, and rotate keys and tokens after any suspected compromise
- Prepare an incident playbook for alert-system compromise: suspend push, post on official channels, and re-enable the map and threat indicators only after review
- Audit third-party integrations and API access to alerting infrastructure
Sources
All live incidents on Threat Watch
