"Mutually assured deception": Hackers hijack Ukrainian and Russian emergency alert apps
"The aim is to generate confusion, create panic and make people doubt the very systems that are there to protect them."
Millions of Ukrainians rely on emergency warning apps to notify them of incoming Russian missile and drone attacks.
But on Sunday night, the technology designed to protect them became a weapon of psychological warfare.
Hackers unleashed 122 false emergency alerts across Ukraine in just seven minutes, warning of incoming missiles, nuclear radiation, chemical attacks, artillery bombardments and fighting in the streets of Kyiv.
Hours later, Russia reported a similar cyberattack against its own emergency warning app, with users receiving terrifying messages claiming nuclear warheads were heading toward the country.
The two incidents have raised the possibility of a new phase of information warfare in which attackers hijack the systems civilians trust to warn them of imminent danger.
Don Smith, Vice President of Threat Intelligence at Sophos Counter Threat Unit, suggested that the incidents could represent a form of "Mutually Assured Deception," a reference to the Cold War doctrine of mutually assured destruction.
He said: "Mutually Assured Destruction is a doctrine used relating to nuclear war. If, as we assume, the Russian incident was a response to the Ukraine incident, Russia might consider that Mutually Assured Deception is at play."
However, neither the perpetrators nor any connection between the two attacks have been independently established.
Seven minutes of fake terror
The first attack began at 22:47 Kyiv time on Sunday, November 1, when Ukraine's official Air Alert app began broadcasting false warnings across the country.
According to an incident analysis published by the independent alerts.in.ua service, 122 bogus warnings were distributed before the attack ended at 22:54.
These included 103 air raid alerts, five radiation warnings, five chemical threat alerts, five warnings of street fighting and four artillery bombardment warnings.
One particularly sinister notification, written in Russian, announced that a nuclear threat was approaching and referred to Russia's Oreshnik ballistic missile.
"Don't worry, Oreshnik is on its way," it said.
Other notifications warned that fighting had broken out in the streets of the Ukrainian capital.
At 23:02, Ukraine's Air Force issued an urgent statement warning that the app had likely been compromised.
"There is no radiation threat whatsoever! Stay calm and follow the updates on our channel!" the Air Force announced.
READ MORE: Russian cyber-spies target UK and European officials via messaging apps
The developers temporarily suspended the app and disabled push notifications while investigating the intrusion.
Although the warnings may have frightened some recipients, the rapid succession of wildly different threats appears to have alerted many Ukrainians to the possibility that something was wrong.
The false alerts also arrived in a country where repeated genuine warnings have become an unavoidable feature of everyday life.
Some Ukrainians receive numerous alerts in a single day, and years of bombardment have left parts of the population accustomed to, or desensitized to, emergency notifications.
The attack nevertheless exposed a potentially serious vulnerability in the country's civilian warning infrastructure.
Alerts with red flags
The incident was not necessarily confined to a single mobile application.
The alerts.in.ua team explained that its independent warning map obtains information automatically through the official Air Alert application's API.
When the official source began distributing false information, those warnings appeared on its service too.
Other platforms using the same data source may have been exposed to the same corrupted information.
The team also reported that a distributed denial-of-service attack against its website began at 22:54, precisely when the final fake warning was recorded.
Its operators began manually removing false alerts at 23:19 and completed the cleanup shortly after midnight.
Crucially, the intrusion did not mean Ukraine's entire civil defense warning infrastructure had been compromised.
Ukraine's State Emergency Service said the national warning system was functioning normally and advised the public to rely on official channels and loudspeaker announcements.
READ MORE: Russian "Laundry Bear" threat actor rinses Western victims with zero-click exploit
The incident also does not establish that attackers penetrated the underlying servers or gained control of the entire emergency warning platform.
The alerts.in.ua team said a compromised administrator account or social engineering attack could potentially have allowed unauthorized warnings to be distributed without a deeper breach.
Don Smith, of Sophos, said the systems responsible for delivering warnings could represent a softer target than the infrastructure they support.
He explained: "Whilst investigating a cyber attack against a TV channel some years ago, it was unclear what the motivation might be. We concluded that whilst it would be very difficult to disrupt the actual broadcast channels, the systems which supported the 'banners' under news items were pure IT systems and could actually be easily targeted.
"These early warning systems will operate in a similar way to allow for broadcasts to be submitted. It is possible that the account of individual with access to submit broadcasts was compromised rather than the core system itself."
Russia's nuclear scare
Just hours after the Ukrainian incident, Russia's Emergencies Ministry announced that its own emergency warning application had suffered a "massive cyberattack."
The ministry said attackers had managed to distribute false information to users and that technical specialists were working to restore normal operations.
According to reports from Russian media, one warning claimed nuclear warheads were heading toward regions across Russia and instructed people to stockpile food and seek shelter.
The ministry emphasized that its principal civilian warning infrastructure had not been compromised.
Sirens, loudspeakers, SMS messages, television and radio remained available, while the mobile application served as an additional source of emergency information.
It did not identify the attackers, and there is no confirmed evidence that the incidents in Russia and Ukraine were coordinated or that one was retaliation for the other.
Nevertheless, the striking similarities have prompted speculation that both countries could be confronting a new form of cyber-enabled psychological warfare.
Smith said the Ukrainian incident appeared intended to undermine the population's ability to withstand the psychological pressures of war.
"Disinformation is as much a part of war as bombs and bullets; targeted information attacks could aim to impact the mental resilience of the people of Ukraine.
"Their resilience is a key part of their ability to defend against the Russian military. Usually the best information warfare is not obvious or explicit, where this very clearly is. It could indicate desperation from Russia."
A new front in grey zone warfare
Graham Taylor CBE, Director Defense Strategy for Northern Europe at OPSWAT and a former British Army officer who served for 27 years, said the attacks demonstrated how civilian services could become targets in modern conflict.
"The attacks on emergency alert applications in Ukraine and Russia are evidence of grey zone activity, where attribution is extremely difficult to assess and plausible deniability remains the modus operandi. The targets in cyber warfare aren’t just militaries, but civilian services and critical infrastructure that people rely on every day.
"The aim is to generate confusion, create panic and make people doubt the very systems that are there to protect them. Information is only as valuable as the trust people can place in it, and that’s why making sure data is safe, secure, verified and free from manipulation is increasingly a mainstream matter of national security.
"When attackers take control of an official system, false information arrives with the supposed authority of a trusted source. It’s far more damaging than a rumor on social media and can spread before the facts have a chance to catch up. Hostile actors exploit this to erode trust, deepen division and weaken confidence in institutions."
The damage caused by such operations may extend beyond the initial shock of receiving a terrifying message.
Every successful manipulation of an emergency system potentially makes the next genuine alert less credible.
That presents a particularly serious danger in Ukraine, where civilians routinely depend on receiving accurate information with only minutes to reach safety.
Dray Agha, senior manager of tactical response at Huntress, said the incidents demonstrated the importance of maintaining independent emergency communication systems.
"We are seeing emergency alert apps targeted specifically to induce civilian panic and confusion. These mobile applications are highly visible targets for attackers.
"Both nations rightly emphasise that apps are only supplementary to physical infrastructure like sirens and radio broadcasts. A resilient national warning system must always rely on multiple independent communication channels so the public can verify threats."
Could the UK be next?
Graeme Stewart, head of public sector at Check Point, warned that the incidents should concern governments far beyond the immediate conflict.
"The prospect of hackers being able to send fake nuclear or chemical attack warnings to millions of people is frightening, particularly when you consider how quickly fear can spread. In Britain, we've only experienced the national Emergency Alerts system a handful of times, and there's still a novelty around it.
"Every time those alarms sound, social media lights up with people sharing screenshots, questioning what's happening and speculating about why they've received one.
"Imagine that happening with a warning of an imminent nuclear attack, particularly in the middle of the night when people are frightened and struggling to verify what's happening. Even if authorities corrected it within minutes, the damage could already have been done.
READ MORE: Russia is secretly waging a cyberwar against the UK, GCHQ chief claims
"The UK's system operates differently from the apps reportedly hacked in Ukraine and Russia, but the incidents raise serious questions about cybersecurity, particularly around who can access emergency warning systems, how alerts are authenticated and whether a compromised supplier could provide a way in.
"AI makes this more concerning because attackers could quickly flood social media with convincing fake footage, fabricated news reports and cloned voices of officials apparently confirming the threat.
"A single false alert could become the spark for a much wider misinformation crisis, with people making potentially dangerous decisions based on what they believe is happening."
For Ukraine, the immediate technical problem appears to have been contained, with the Air Alert service subsequently restored and its developers promising additional security measures.
But the wider danger is harder to eliminate.
An emergency warning network depends on more than secure servers, authenticated messages and resilient communications infrastructure.
It also depends on the willingness of ordinary people to believe what it tells them.
And in a country under constant bombardment, convincing civilians to ignore the next warning could prove far more destructive than frightening them with a false one.
