Russia Cyber Attack: Fake Nuclear Alerts Hit Both Sides. What Is Known

A Russia cyber attack on the country’s Emergency Situations Ministry app, and a separate hack of Ukraine’s national Air Alert app, produced false nuclear warnings on both sides of the front line between November 1 and 2, 2026. Al Jazeera reported that Moscow described a “massive cyberattack” hours after Kyiv said its own app had been compromised. The episode matters because it landed within hours of the end of a rare local ceasefire, and because spurious nuclear alerts can cause panic and complicate crisis signalling.

What happened to the alert apps in Russia and Ukraine?

In Ukraine, the Air Alert app, which millions of residents use for warnings of incoming missile and drone strikes, sent Kyiv residents a “nuclear danger” notice late on Sunday, according to Bloomberg. It then pushed alerts about chemical danger and street fighting. Meduza reported that one message, written in Russian, said a nuclear alert would sound across Ukraine and that the Oreshnik, a Russian hypersonic missile, was coming.

Ukraine’s Air Force told users on Telegram that the app appeared to have been subjected to hostile influence. It added: “There is no radiation threat.” According to Euronews, Ukraine’s State Emergency Service said the national system was working normally again by midnight. Al Jazeera reported that a separate app for the capital had operated normally throughout.

In Russia, the Emergency Situations Ministry said on Telegram overnight Monday that its mobile app had been hit by an extensive attack that let intruders send false information to the public, as The Copenhagen Post relayed from AFP. According to Meduza, users received notices that nuclear warheads had been launched across all Russian regions. The ministry said the wider alert system was unaffected and that the app is a supplementary service alongside SMS, broadcasts and sirens, according to CP24.

Who is behind the Russia cyber attack claims?

No government has publicly and verifiably attributed both incidents. Ukraine’s Centre for Strategic Communications, known as SPRAVDI, blamed Russia for the hack of the Air Alert app, per Al Jazeera. The Russian ministry did not say who attacked its app.

The Associated Press, as carried by ClickOnDetroit, reported that one of the false posts mentioned a hacking group called Hitcore. Mash, a Russian Telegram channel with links to the security services, said Hitcore representatives claimed responsibility. Separately, UNN reported that ATESH, a pro-Ukrainian group, said it hacked the Russian ministry app, and noted there was no independent confirmation.

These claims point in opposite directions and none has been corroborated by forensic findings released by officials. Kremlin spokesperson Dmitry Peskov said Russian state agencies face constant cyber threats, according to CP24, without assigning blame for this incident. France 24’s live coverage also cited Interfax as reporting that Russia’s state statistics service was a target of cyberattacks, though details were limited.

Why does the timing matter for the war?

The incidents followed the end of the longest truce of the war. According to France 24, the truce was limited to the Kherson region and ended on Sunday after Russia refused an extension, according to Kyiv. Ukraine’s human rights commissioner, Dmytro Lubinets, said the ceasefire ran from October 27 to November 1. Euronews reported that Russia resumed attacks on Kherson on Monday. The pause had allowed a humanitarian mission to Russian-occupied Oleshky, a development covered in an earlier Intelligence Report piece on the Oleshky ceasefire.

Cyber operations aimed at public warning systems are a form of information warfare: the goal is less to damage infrastructure than to erode trust in official alerts. The nuclear framing carries added risk, since false warnings of a strike can feed rumours in a population already living under daily attacks. Both governments moved quickly to say real warning channels, such as sirens, were still working, and Ukraine’s Ministry of Digital Transformation made the same point, according to The Copenhagen Post.

Fake alerts of this kind are not new in the conflict. A 2023 incident in which hackers disrupted Russian broadcasts with a false air raid warning was reported by The Daily Telegraph, and Moscow then blamed a cyberattack. The latest episode differs in that both countries reported compromised apps within hours of each other.

The strikes continue alongside the cyber activity. Euronews reported that Russia described a large drone attack on an industrial enterprise amid reports an oil refinery was hit, a theme explored in Intelligence Report’s coverage of renewed Ukrainian refinery strikes.

What to watch

• Official attribution: whether Kyiv, Moscow or Western cyber agencies publish technical findings on either hack, and whether Hitcore or ATESH claims are supported.
• App restoration: whether Ukraine’s Air Alert notifications, which were temporarily disabled, return fully, and whether Russia’s ministry app is restored.
• Kherson front: whether attacks on the region intensify now the truce has lapsed, and whether either side revives the idea of another humanitarian pause.
• Further incidents: repeat hacks of alert, statistics or other public services in either country in the coming days.
• Diplomatic framing: whether either government raises the incidents at the UN or in talks, noting that Al Jazeera cited the Kremlin as saying European countries are not included in the next Ukraine talks.

Frequently asked questions

Sources

• Russia, Ukraine air raid alert apps hit by cyberattacks after truce ends
• Ukraine and Russia Report Cyberattacks on Emergency Alert Apps
• Emergency alert apps hacked in Russia and Ukraine, sending false warnings of nuclear threats
• Russia and Ukraine report suspected cyberattacks on public emergency alert apps
• Ukraine and Russia both report cyberattacks on emergency apps
• Ukraine and Russia report fake emergency alerts after cyberattack targets apps
• Russia resumes attacks on Ukraine's Kherson region after truce ends, Kyiv says
• Live: Russia and Ukraine trade blame for cyber attacks as fragile ceasefire ends
• After fake alerts in Ukraine, someone hacked Russia's Emergency Situations Ministry app
• Fake air raid alert tells Russians to head for nuclear bomb shelter

Top image: UKRAINE: Reference map of relevant area of Kherson Province Independent Internat... / Wikimedia Commons (CC BY 3.0)

This article was produced by the Intelligence Report Desk. Sources are linked below.