On the evening of Nov.1, hackers attacked the Ukrainian app Povitriana Tryvoha (lit. “Air Alert”). Users received messages about radiation and chemical hazards, the threat of street fighting in Kyiv, and a supposedly imminent Russian strike with an Oreshnik ballistic missile. According to data from the eTryvoga service, the first false warnings appeared at about 10:48 p.m. Kyiv time.
Then, around three hours later, Russians were targeted with similar warnings after hackers breached the mobile app of Russia’s Ministry of Emergencies and used it to spread false warnings about the supposed launch of nuclear warheads across the country. Similar messages appeared in the ministry’s official regional channels and operational headquarters channels.
The ministry confirmed the cyberattack. At around 2:45 a.m. Moscow time, users of the Emergencies Ministry app began receiving notifications about the launch of nuclear warheads on P1-SUN delivery systems. The authors of the messages urged Russians to stock up on three weeks’ worth of food and take shelter in basements. The text was accompanied by profanity. Identical warnings appeared in at least ten regions, including St. Petersburg, the Moscow, Nizhny Novgorod, Tyumen, Tula, Chelyabinsk, and Belgorod regions, Perm and Stavropol territories, and Bashkortostan. The messages were also spread through the ministry’s channels on the Max and Telegram messengers.
The P1-SUN mentioned by the hackers does exist — but it is a Ukrainian interceptor drone made by SkyFall and designed to destroy Russian attack drones.
The Russian Ministry of Emergencies said that specialists are fixing the vulnerability in the mobile app and restoring its operation. At the same time, the ministry claims that the cyberattack did not affect the main public warning system. According to the ministry, sirens, loudspeakers, text message alerts, and television and radio broadcasting are operating normally. The ministry describes the mobile app as an auxiliary information channel. It did not disclose the number of users who received the false warnings or technical details of the hack.
The developers of Ukraine’s Povitriana Tryvoha app confirmed the unauthorized interference in its operation and temporarily disabled push notifications, and the developers of eTryvoga had to temporarily suspend the automatic transmission of warnings. Later, both services began restoring operations. Ukraine’s State Emergency Service said that the nationwide alert system continues to work.
It remains unknown who is behind the two cyberattacks. Despite the similarity of the false warnings and the short interval between the incidents, there is so far no confirmation that the hacks in Russia and Ukraine were organized by the same people.
Hackers have interfered with Russian emergency alert channels before. In February 2023, false air raid warnings sounded via radio and television in several regions of Russia and in annexed Crimea, with the Emergencies Ministry stating that its servers had been hacked. The Insider later noted that, according to Russian outlet Vedomosti, the attackers had spoofed the signal from the Yamal-402 satellite, which is owned by Gazprom Space Systems.