---
title: "Two Alert Apps, One Night, Zero Real Warheads: Inside the Kyiv-Moscow Hack Swap"
description: "122 fake alerts hit Ukraine’s Air Alert app in seven minutes; four hours later Russia’s own warning app pushed a fake nuclear strike to 33 regions"
author: "Luis Goa"
published: 2026-11-02T09:35:46Z
modified: 2026-11-02T15:28:04Z
url: https://rews.cc/a/two-alert-apps-one-night-zero-real-warheads-inside-the-kyiv--656dbf
language: en
tags: ["cybersecurity", "war", "ukraine", "russia", "nuclear", "world"]
publisher: "Rews (https://rews.cc)"
---

# Two Alert Apps, One Night, Zero Real Warheads: Inside the Kyiv-Moscow Hack Swap

*122 fake alerts hit Ukraine’s Air Alert app in seven minutes; four hours later Russia’s own warning app pushed a fake nuclear strike to 33 regions*

By Luis Goa · November 2, 2026 · https://rews.cc/a/two-alert-apps-one-night-zero-real-warheads-inside-the-kyiv--656dbf

## In brief

- Ukraine’s Air Alert app sent 122 fake radiation, chemical and combat alerts in 7 minutes on Nov 1
- Russia’s EMERCOM app pushed a fake nuclear-strike warning to 33 regions about 4 hours later
- Neither country’s real warning network (sirens, radar, broadcast) was affected, officials said
- Hacking group Hitcore claimed the Ukraine breach via phishing; Ukraine blamed Russia; DC8044 and ATESH both claimed the Russia breach
- Attacks coincided with the end of a Melania Trump-brokered local truce around Kherson

In seven minutes, from 22:47 to 22:54 on November 1, someone pushed 122 fake push notifications through Ukraine’s Air Alert app: 103 air-raid warnings, five for radiation, five for chemical attack, five for street fighting in Kyiv and four for incoming artillery, according to the minute-by-minute log kept by the volunteer monitoring project alerts.in.ua and reported by the Ukrainian outlet Mezha. None of it was real. Four hours later, at 02:45 Moscow time, Russia’s own emergency-alert app pushed an equally fake message to 33 regions: “NUCLEAR WARHEADS ON P1-SUN DELIVERY SYSTEMS have been launched across ALL regions of Russia,” telling recipients to stock three weeks of food and head for the basement, according to Russia’s Emergency Situations Ministry, EMERCOM.

Neither country’s actual warning infrastructure was touched. That matters for how you read this, and it is the detail every outlet’s headline buried. Air Alert, built in 2022 by Ukraine’s Ministry of Digital Transformation with the security-hardware firm Ajax Systems, is a relay: a backend that packages data from the state’s real detection network — radar, acoustic sensors, the Air Force’s own command feed — into push notifications for a phone app that [had 6.6 million active users as of January 2026](https://therecord.media/ukraine-hackers-russia-alert-system), per Ajax’s own disclosure cited by Recorded Future News. It is not the command chain. Ukraine’s Air Force said, through spokesman Yurii Ihnat, that the breach had no effect on actual air defense or security operations, because the app sits outside military systems entirely. EMERCOM made the same point about its own app after the Russian incident: sirens, loudspeakers, SMS and broadcast remain the operative channels, and the compromised app “has not affected and cannot affect the operation of the public warning system.”

That architecture is exactly why the attack was cheap. Compromise the one account with publishing rights to the notification backend, and you can broadcast to millions of phones without ever touching a sensor, a radar feed or a government network with real access controls. Ukraine’s Air Force said on Telegram that the app “had likely been compromised by the enemy”; the developers’ own statement said “unauthorized individuals interfered with the app’s operation,” disabled push notifications and suspended the service rather than try to filter fake messages in real time.

**How one hacked account became two countries' fake alerts** Reconstructed from alerts.in.ua, Ajax Systems, EMERCOM and The Record's reporting

| From | To | How |
| --- | --- | --- |
| Hitcore Corp *(previously unknown group, claims credit)* | App admin's device *(Hitcore says it sent malware as a photo)* | targets |
| App admin's device *(Hitcore says it sent malware as a photo)* | Air Alert push backend *(Ajax Systems, 6.6M users)* | compromises |
| Air Alert push backend *(Ajax Systems, 6.6M users)* | 122 fake alerts in 7 minutes *(22:47–22:54, Kyiv, Nov 1)* | pushes |
| 122 fake alerts in 7 minutes *(22:47–22:54, Kyiv, Nov 1)* | App suspended *(notifications disabled)* | forces |
| App suspended *(notifications disabled)* | Service restored *(~01:52, map features still limited)* | two hours later |
| Service restored *(~01:52, map features still limited)* | EMERCOM alert app *(breached via API, per DC8044's claim)* | ~4 hrs after Kyiv incident |
| EMERCOM alert app *(breached via API, per DC8044's claim)* | Fake alert to 33 regions *(02:45 Moscow time)* | pushes |

![How one hacked account became two countries' fake alerts. Reconstructed from alerts.in.ua, Ajax Systems, EMERCOM and The Record's reporting](https://rews.cc/img/7ba142ec6c79bcc0cfa9ec346be9489e0f37a479.webp)

Based on [alerts.in.ua, Ajax Systems, EMERCOM, The Record](https://therecord.media/ukraine-hackers-russia-alert-system)

Restoration followed its own timeline, per alerts.in.ua: the DDoS attack that hit the monitoring site started at 22:54, the moment the fake alerts stopped; developers began stripping fake records from the map and history at 23:19; a mass “all clear” went out at 23:47; the fake records were fully purged by 00:03; the first genuine air-raid alert after the incident fired at 00:05; and the team reported gradual restoration of full functionality around 01:52, with the live target-tracking map still partly disabled while they added what they called additional security measures. On the Russian side, EMERCOM said its specialists had “analyzed the incident and identified the vulnerability exploited by the attacker” and expected full functionality back by the end of the day — a claim neither ministry has backed with a technical writeup.

The content of the messages leaned on each side’s specific fears. One Ukrainian notification, in Russian, read: “There will be a nuclear alert across all of Ukraine right now! Don’t worry, the Oreshnik is coming” — a taunt built around Russia’s nuclear-capable intermediate-range missile, first used operationally against Ukraine in 2024. The Russian fake, by contrast, invoked a weapon that does not exist under that name: “P1-SUN delivery systems” appears to be a garbled reference to Ukrainian long-range strike drones, bolted onto the word “nuclear” for effect. Whoever wrote it was optimizing for dread, not accuracy, on both ends.

![A red mushroom cloud shaped balloon floats above a smartphone, tethered to it by a dark string against a teal background.](https://rews.cc/img/b87946380d7651a5dbc88bd2d35a96277986aaa6.webp)

Attribution is where the story turns soft, and an engineer should treat every claim here as a claim, not a finding. A link in the fake Ukrainian alerts pointed to a Telegram channel for a group calling itself Hitcore Corp, previously unknown, which claimed the breach; speaking to the Russian outlet Mash, the group said it got in by sending an Air Alert administrator malware disguised as an explicit photo — classic spear-phishing against a human, not a flaw in the app’s code. That account is Hitcore’s own and has not been independently verified. Ukraine’s Center for Strategic Communications blamed Russia for the operation outright. On the Russian app, the self-described Kyiv-based group DC8044 told The Record it breached EMERCOM’s app through its [application programming interface](https://therecord.media/ukraine-hackers-russia-alert-system), publishing technical details on Telegram; separately, the pro-Ukrainian partisan network ATESH also claimed the hack. No group’s account of the Russian breach has been confirmed, and Moscow has named no suspect.

Hijacking the relay layer of a civilian alert system, rather than the warning infrastructure itself, is not new. Russian regional radio and TV broadcasts were hacked in 2023 to air fake air-raid and [nuclear-shelter warnings](https://www.aol.com/fake-nuclear-bomb-alert-tv-123855102.html), and that same year the pro-Palestinian group AnonGhost exploited an API flaw in Israel’s Red Alert rocket-warning app to send a fake “nuclear bomb” notice, an intrusion [Group-IB’s threat-intelligence team documented](https://cybernews.com/cyber-war/israel-redalert-breached-anonghost-hamas/) in detail, down to the exposed endpoints AnonGhost scripted against in Python. The pattern across all three incidents is the same: the civilian notification app is built for reach and speed, not for verifying who is allowed to publish to it, and reach is exactly what a psychological operation needs.

![A black hand inserts a golden key into a cream megaphone with black lightning bolts projecting from its opening against a teal background.](https://rews.cc/img/51ca51535305449443344761126b1a8e6ee277da.webp)

The timing sits inside a larger pattern this war keeps producing: digital disruption timed to political moments. The attacks landed the same day a local truce around Kherson, [brokered by US First Lady Melania Trump](https://www.yahoo.com/news/world/articles/russia-resumes-strikes-kherson-truce-113707422.html) and running from October 27 to November 1 without either side reporting violations, lapsed and fighting resumed. It is the kind of coincidence that invites a causal story neither government has supplied on the record. What both incidents share with the [tit-for-tat strikes on each other’s data centers](https://rews.cc/a/ukraine-hits-a-fourth-russian-data-center-in-a-week-and-the--d95cc7) that preceded them is a legal and attribution vacuum: anonymous actors, competing claims, no court or treaty that assigns responsibility for spoofing a civilian alert feed in wartime. EMERCOM says it has found and will patch its vulnerability by the end of the day it was disclosed. Ajax Systems has not published what let an unverified device publish to 6.6 million phones in the first place. That gap, not the fake warheads, is the number worth watching next.

## See also

- [Злам додатку «Повітряна тривога» показав 122 фейкові тривоги за 7 хвилин](https://mezha.ua/news/zlam-dodatku-povitryana-trivoga-316766/) — mezha.ua · Minute-by-minute alerts.in.ua timeline of the Ukrainian breach