Ukraine partially restores alert app hacked to spread fake nuclear warnings
Ukraine's official air alert app, built by Ajax Systems with 6.6 million active users as of January 2026, was hacked late on Sunday and sent fake warnings of radiation, chemical threat and street fighting in Kyiv; one message, written in Russian, cited the Oreshnik missile and promoted a Telegram channel of the Hitcore Corp group, which claimed the breach. Developers suspended the service and, by early Monday, restored push notifications and basic threat indicators while keeping the map disabled; attribution to Russian hackers remains unconfirmed, and g1 reported that false alerts were fired again in Russia and Ukraine after a local truce ended. Users should ignore links in suspicious alerts, such as the promoted Telegram channel, and rely on official channels; the national warning system kept operating normally, according to the State Emergency Service.
What happened
Hackers breached Ukraine's official air alert app, built by Ajax Systems, and sent fake warnings about radiation, a chemical threat and street fighting in Kyiv; one message in Russian cited the Oreshnik missile and promoted a Telegram channel. A group calling itself Hitcore Corp claimed the breach. Developers suspended the service and have restored push notifications and basic threat indicators, with the map still disabled.
Why it matters
The app has 6.6 million active users and is a trusted source of missile and drone warnings; false alerts at this scale cause panic and erode public trust in real warnings, exactly when Ukrainian authorities expected a possible large-scale Russian strike. The Air Force and the counterdisinformation center had to publicly debunk the alerts and urge calm.
What to do
Tell people in Ukraine to ignore links in suspicious alerts, such as the promoted Telegram channel, and verify warnings through official channels like the Air Force and the emergency service. For your own consumer apps, review who can access the notification pipeline and how to shut off sends within minutes.
For the technical team
- Affected
- Defesa civil da Ucrânia Sistema nacional de alerta de ataques aéreos da Ucrânia, incluindo o aplicativo oficial de alarmes e sirenes físicas · The Air Alert app by Ajax Systems, launched in 2022 with support from Ukraine's Ministry of Digital Transformation; 6.6 million active users as of January 2026. Authorities said the national warning system and the Kyiv Digital app were not affected; on the Russian side, the Emergency Situations Ministry's (EMERCOM) mobile app was hacked.
- Exploitation
- Breach confirmed by the developers, who said 'unauthorized individuals interfered with the app's operation', and by Ukraine's Air Force, which said the app had 'likely been compromised by the enemy'; a group calling itself Hitcore Corp claimed responsibility; attribution to Russian hackers remains unconfirmed.
- Fix
- No software fix disclosed. Mitigation applied by developers: push notifications disabled and service suspended, then gradual restoration of pushes and basic threat indicators with the map disabled, plus additional security measures being implemented.
- Vector
- Breach of Ukraine's official air alert app: unauthorized individuals interfered with the app's operation and sent fake push notifications, using the app's standard voice and arriving even with phones in silent mode; the initial access vector was not disclosed. In the retaliatory attack on Russia's EMERCOM app, the group DC8044 claimed access through the API.
- More details
- A Recorded Future News reporter received the notifications, which appeared genuine and used the app's familiar voice; one message in Russian cited Russia's Oreshnik missile, capable of carrying nuclear warheads. Hours later, DC8044, which describes itself as a Kyiv-based cybersecurity and hacking community, published technical details on Telegram and claimed a breach of the EMERCOM app via its API, sending fake warnings that nuclear warheads had been launched toward Russia; Russia's ministry confirmed the app hack and denied impact on the public warning system. Precedents cited by Recorded Future News: in 2023, Russian commercial radio infrastructure was hacked with fake air raid warnings, and, per Group-IB, the AnonGhost group compromised Israel's Red Alert app with a fake nuclear bomb warning.
Timeline
Brazil's g1 reports hackers again triggered false alerts in Russian and Ukrainian systems after the local truce ended.
The Record reports the attack on Ukraine's alert system prompted a hacking group to breach a similar Russian emergency alert system in retaliation.
Post attributes the hack of Ukraine's official alert map to Russian hackers.
Want the next updates in your inbox? Get the daily edition →
See all 9 updates
Post attributes the attack to Russians and says the fake alert sent to Ukrainians was not in Ukrainian.
Batch adds fake chemical and nuclear attack warnings in Kyiv, a 'ZOV' message on the map, the app's shutdown, and reports of devices hacked via a Telegram link.
New reports attribute full access to the alert apps to Russian hackers and expand the false warnings to nuclear and chemical attacks.
Social media post attributes the attack to Russians and reports nuclear threats sent through the official alarm app; attribution remains unconfirmed.
Reports detail fake radiation and chemical threat warnings pushed to phones across the country; street loudspeakers in Kyiv also blared a similar message, and Ukraine's air force said there is no radiation threat and asked people to remain calm.
First reports describe the hijack of the alert system, with physical sirens triggered and false warnings across several regions.
Sources 16 sources
- @WarMonitor3 @WarMonitor3
- @reshetz @reshetz
- @TreyYingst @TreyYingst
- @FaytuksNetwork @FaytuksNetwork
- @RWApodcast @RWApodcast
See all 17 sources
- @TreyYingst @TreyYingst
- @BNODesk @BNODesk
- @gghamari @gghamari
- @Holstered @Holstered
- @SU_57R @SU_57R
- @wartranslated @wartranslated
- @Polymarket @Polymarket
- @Alex_Oloyede2 @Alex_Oloyede2
- @BohuslavskaKate @BohuslavskaKate
- @AMK_Mapping_ @AMK_Mapping_
- Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings The Record
- @g1 @g1
