Zelensky Says Ukraine Hacked Russia's Emergency App Back After Fake Nuclear Alerts Hit Phones in Kyiv

Late on Sunday, the app millions of Ukrainians rely on to know when to run from missiles told people in Kyiv to fear radiation, a chemical threat and street fighting in the capital. Hours later, the app of Russia's emergencies ministry told its users that nuclear warheads were flying at every region of the country.

Neither was true. Volodymyr Zelensky then went on PBS and said the second hack was Ukraine's answer to the first. "They attacked our system. It was a cyberattack," Zelensky told Amna Nawaz. Once it was clear the attack targeted civilians, "Of course, we responded." And: "We only respond on their attacks."

A familiar voice, a fake warning

The Ukrainian alerts looked genuine and used the app's familiar announcement voice. Red-level air raid warnings went out across the country. One message, in Russian, warned of a possible strike with the Oreshnik, a ballistic missile that can carry nuclear warheads, and linked to the Telegram channel of a previously unknown group calling itself Hitcore Corp, which claimed responsibility. Zelensky blames Russia, but no investigator has formally named who was behind it.

Air Alert launched in 2022 after the full-scale invasion, built by Ajax Systems with support from Ukraine's Ministry of Digital Transformation. It had 6.6 million active users as of January and works even on phones set to silent, which is exactly what makes it worth hijacking.

Kyiv resident Olena told the BBC her first thought was that she was not prepared. She was ready for blackouts and cuts to heating and water, "but not for nuclear attack." She worked out it was a hack when an alert arrived in Russian, since their notifications come in Ukrainian.

The Air Force said the app had "likely been compromised by the enemy" and that there was no radiation threat. Developers disabled push notifications, briefly suspended the service and warned users not to open links in suspicious messages. By early Monday, notifications and basic threat indicators were back, while the map of incoming threats stayed off.

The timing was not comfortable. The alerts landed minutes before the end of a localized ceasefire in the Kherson region, arranged to evacuate civilians from Russian-occupied Oleshky, and authorities had warned of a possible large strike on Kyiv's energy infrastructure.

Warheads on drones

Hours later, a group calling itself DC8044, which describes itself as an independent hacking community based in Kyiv, claimed it had breached the app of Russia's Emergencies Ministry through its API. A purported screenshot shared by the partisan group Atesh said "nuclear warheads mounted on P1-Suns," a Ukrainian attack drone, had been launched at all regions of Russia. It told people to stock up on food for three weeks and hide, and it threw in some profanity.

The ministry said the hack "has not affected and cannot affect the operation of the public warning system," meaning sirens, loudspeakers, SMS, TV and radio, and promised full app functionality by the end of Monday. Kremlin spokesman Dmitry Peskov said Russian government sites are under constant cyberattack and blamed the spread of AI.

Cyber experts told the BBC the attackers on the Russian app likely had the capability for some time and held off until Ukraine's app was hit. The informal language pointed to hacktivist groups that may be aligned with Moscow or Kyiv without being formally directed by either.

The next panic button

The cyber front of this war has been busy, from the Dahua cameras that CERT-UA warned last month were being hijacked by guessing serial numbers to now the alerts themselves. Fake warnings have precedent too: in 2023 hackers hijacked Russian commercial radio with fake air raid warnings, and Group-IB reported that hacktivists sent some users of Israel's Red Alert rocket app a fake nuclear bomb warning.

Ukrainian MP Oleksander Merezhko said Sunday's alerts caused no panic and called them "part of cyber war." The damage may be slower than panic. Some Ukrainians told the BBC they have already disabled the app after four and a half years of nightly alerts.

Stanford's Herbert Lin said it was probably the first time this has happened to an official Ukrainian information app, "but I suspect it won't be the last."

Some offers on this page may be paid placements or contain affiliate links.