The short version
- Unknown actors infiltrated Ukraine’s emergency alert application to distribute false warnings about imminent nuclear strikes and chemical hazards in Kyiv.
- The cyber incident occurred as a six-day ceasefire in the Kherson region expired, allowing Russian forces to reinforce positions and move heavy equipment.
- Ukrainian officials suspended the compromised channel while Russian state-linked channels claimed responsibility for the breach without independent verification.
A coordinated cyberattack targeted Ukraine’s nationwide emergency alert mobile application late Sunday, broadcasting fabricated warnings to residents in Kyiv. The unauthorized messages claimed that the capital faced an imminent nuclear strike and a chemical threat, alongside reports of intense street fighting. These alerts appeared shortly before 11 p.m. local time, creating confusion and fear among some citizens who were accustomed to relying on the app for genuine safety information during ongoing hostilities.
The false notifications were distributed in both Ukrainian and English, with the English text containing noticeable spelling errors that suggested amateurish origins or deliberate obfuscation. One message, written in Russian, specifically warned of incoming Oreshnik missiles, a type of ballistic weapon capable of carrying nuclear warheads that Moscow has previously deployed against Ukrainian cities including Kyiv, Dnipro, and Lviv. The specificity of the threat likely contributed to the anxiety experienced by some recipients, despite the obvious irregularities in the communication style.
Public reaction to the breach was mixed. Many residents in Kyiv dismissed the alerts immediately, recognizing the signs of a compromised system and assuming the messages were malicious fabrications. However, others reported feeling genuine terror during the brief period before they could verify the situation. One resident described lying in bed, paralyzed by uncertainty about what kind of attack might be unfolding. The incident highlights the vulnerability of digital infrastructure in modern warfare and the psychological impact of information manipulation.
Ukrainian authorities responded quickly to contain the breach. The official channel for the emergency app announced that unauthorized parties had interfered with its operations and temporarily suspended the service. Users were advised not to click on any links contained within suspicious notifications. The government has not yet identified the specific group responsible for the intrusion, leaving the motive behind the attack unclear. It remains uncertain whether the goal was to cause panic, disrupt civil order, or test the resilience of Ukraine’s digital defense systems.
In Russia, state-affiliated media outlets claimed that hackers had also targeted emergency services in Moscow. A Telegram channel linked to Russian security services reported speaking with representatives of a hacking group called Hitcore, which allegedly claimed responsibility for the attacks on both sides. However, these claims could not be independently verified. The Kremlin has not officially confirmed involvement in the cyber operations against Ukraine’s alert system, maintaining its usual stance of plausible deniability regarding state-sponsored cyber activities.
The timing of the cyberattack coincided with significant developments on the ground in southern Ukraine. Just hours after the expiration of a six-day ceasefire in the Kherson region, Russian forces resumed attacks on the city. The truce, which was brokered by the White House and facilitated by First Lady Melania Trump, had allowed for the evacuation of hundreds of civilians from Oleshky, a town controlled by Russian forces near the front line. Both sides initially praised the pause in fighting as a success, with Ukrainian officials suggesting it could serve as a model for future humanitarian corridors.
However, evidence suggests that Russian military units used the ceasefire to strengthen their defensive positions and rotate fresh troops into the area. Footage obtained by news organizations showed soldiers deploying heavy military equipment, delivering ammunition, and moving armored vehicles through the streets of Oleshky. Before the truce, such movements were difficult due to the threat from Ukrainian kamikaze drones. The ability to resupply and reposition forces without interference represents a tactical advantage for Russian commanders in this sector.
Kherson’s military administration reported that a Russian drone struck a hospital early Monday morning, causing damage to rooms and breaking windows, though no injuries were confirmed. Video footage showed debris scattered on the streets and wrecked interiors. The removal of civilian bodies from a hospital morgue during the ceasefire period has also been noted by observers. These actions indicate that while the pause in direct combat allowed for humanitarian efforts, it did not halt all military activities or prevent further escalation once the agreement expired.
Dmitry Pulinets, commander of Ukraine’s 34th Separate Marine Brigade, noted that Russian soldiers had previously been unable to move freely in the city due to constant drone threats. He stated that the ceasefire provided them with an opportunity to operate openly during day and night. Ukrainian Ombudsman Dmytro Lubinets, who coordinated the evacuation mission, expressed hope that similar truces could be implemented elsewhere along the frontline. However, Russian spokesperson Dmitry Peskov dismissed the idea of extending the pause, calling troop regrouping standard practice and assuming Ukrainian forces had done the same.
As the immediate threat of the fake alerts subsided, attention shifted back to the physical battlefield. The end of the Kherson ceasefire marks a return to active combat in one of the most contested regions of the war. The combination of cyber warfare and conventional military maneuvers underscores the complex nature of the conflict, where digital domains and physical frontlines are increasingly intertwined. Authorities continue to monitor both online threats and ground movements to protect civilians and maintain operational security.
Sources behind this briefing
Go to the original reporting
- The Guardian World↗Hackers send fake nuclear threat alert to Ukraine emergency app
