Ukrainian Air Force

Summary

The Ukrainian Air Force reported that its air raid alert application was compromised, triggering false nationwide warnings of radiation, nuclear, chemical, and street fighting threats while sirens sounded across multiple regions. Messages in Ukrainian and Russian referenced an incoming strike and urged residents to take cover, though officials stated there was no actual danger and warned against clicking suspicious links. The false alerts were cleared within roughly an hour, after which the system began gradually resuming normal operations with added security measures, while a separate emergency app in Russia was also reported hacked shortly afterward.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On the evening of November 1, 2026, Ukraine's Air Alert application was compromised, triggering false warnings across the country. The alerts began at approximately 22:47 local time, when red-level air raid signals were reportedly issued nationwide. Users in Kyiv received a sequence of messages starting with a radiation threat declaration, followed by a Russian-language warning about a nuclear alert and the Oreshnik missile, then a chemical attack warning for Kyiv, and finally a street fighting threat warning for the capital. Similar false alerts activated street sirens in multiple regions, including Zakarpattia Oblast in western Ukraine. The Ivano-Frankivsk Oblast experienced a red-level air raid alert between 22:50 and 23:57 despite the governor reporting that the situation was calm. In the Lviv region, the compromised application caused radiation hazard signals to play on loudspeaker devices. The Vinnytsia region was also affected, with its regional head confirming a cyberattack on the notification app. The false messages instructed residents not to go outside and referenced threats that did not exist.

The Ukrainian Air Force stated on Telegram that the Air Alert application had likely been subjected to hostile interference by the enemy and that there was no radiation threat. Ukraine's Center for Countering Disinformation described the application as likely compromised. The Ministry of Digital Transformation, which supports the app, said it had been temporarily disabled for maintenance after apparently being compromised. The Air Alert app, developed in collaboration between the ministry and security technology company Ajax Systems, is designed to inform users instantly about the beginning and end of defence alerts. By midnight local time, Ukraine's State Emergency Service reported that the nationwide alert system had returned to normal operation. At around 2 a.m. local time, the app's official Telegram channel announced that operations were being gradually restored while the display of targets remained temporarily suspended. The channel added that the team was implementing additional security measures to protect the app and prevent similar incidents, and reiterated that the app does not store or use personal data.

Regional officials issued statements through Telegram to counter the false alarms. The governor of Ivano-Frankivsk Oblast said the situation in the oblast was calm and that reports indicated a cyberattack on the notification app. The head of Vinnytsia Oblast warned of a cyberattack on the Air Alert app and cautioned against clicking links in messages, describing them as potential phishing attempts. For residents of Kyiv, the Digital Transformation Ministry recommended using the Kyiv Digital app to remain aware of air alerts. At 23:53, a series of all-clear messages were delivered to users' phones, individually declaring each previous Kyiv threat clear. The false alerts had lasted roughly an hour before being cleared. The Ukrainian Central Intelligence Agency urged people to use other sources of information to clarify the situation on the threat of air strikes.

The incident occurred just minutes before the end of a localized ceasefire in Ukraine's front-line Kherson region, which had been implemented the previous Tuesday and officially ended at 23:00 on Sunday. Fighting had continued elsewhere during the ceasefire to allow civilians to evacuate the Russian-occupied city of Oleshky. A few hours after the false alerts in Ukraine, Russia's Ministry of Emergency Situations said its own mobile app had been subjected to a massive cyberattack that sent fake information to the public, with no further details provided. Ukrainian news outlet UNN reported that the hack sent fake alerts of a nuclear threat inside Russia. The Ukrainian partisan group Atesh, operating inside Russian-held territory, claimed responsibility for hacking the app and published a screenshot of a purported emergency alert urging users to stock up on provisions for three weeks and take cover in basements, though the BBC could not verify the screenshot. Russia launched its full-scale invasion of Ukraine in February 2022.

Sources

Sources available to members: 3 sources.