EXPLORINEER
en

UK — The Register

Nuclear threats and street brawls: Russia, Ukraine report attacks on their emergency alert apps

Security1 min read

Hackers sent fake emergency alerts through the official alert apps of Russia and Ukraine on the same Sunday evening. The fake messages warned people about missile, nuclear and street-fight threats.

What happened

On Sunday evening, attackers broke into the emergency alert apps of both Russia and Ukraine. Both apps sent fake messages to phones. The fake messages talked about missile strikes, nuclear strikes, chemical attacks and street fights. Officials from both countries confirmed the attacks.

Key facts

  • Ukraine's Air Force warned about the attack first, at about 2100 UTC on Sunday.
  • Russia's Ministry of Emergency Situations confirmed its app was hit at about 0030 UTC on Monday.
  • Russia's ministry fixed the app about 90 minutes later, and said it was working normally again.
  • One fake alert in Russian mentioned the "Oreshnik" missile. This was a clue that the message was not real.
  • Fake Russian alerts also named "P1-Sun", the name of a Ukrainian attack drone.

What an alert app does

An emergency alert app is a phone program that warns people about danger, such as air attacks. Governments also use sirens, text messages, TV and radio to warn people. Russia's ministry said the app is only an extra source of information. Ukraine's ministry reminded people to use other official sources while its app was down.

Why it matters

Fake nuclear warnings can cause fear and panic. Attacks like this show that official warning tools can be used to spread lies during a war. Ukraine's lawmaker Oleksander Merezhko said the attack was part of a cyber war. Russia has not clearly blamed Ukraine, and its app is now said to be working normally.

What to watch

  • Whether Russia or Ukraine officially blames the other for the attacks.
  • Whether more fake alerts appear on either country's apps.
  • How officials make their alert apps safer after the attacks.
  • How the attacks connect to the end of the six-day ceasefire in Kherson.

Glossary

Oreshnik
The name of a Russian missile mentioned in one of the fake alerts.
P1-Sun
The name of a Ukrainian attack drone, mentioned in fake Russian alerts.
ceasefire
A pause in fighting agreed by the sides in a conflict.

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityITmedia

GMO press conference repeats "hourglass of life"; Internet users pile on criticism of CEO Kumagai's remarks

GMO Internet Group held a press conference on November 2 over unauthorized access to its "Onamae.com Desktop Cloud" VPS used for FX automated trading. CEO Masatoshi Kumagai repeatedly used the phrase "hourglass of life," which trended on X, while many users criticized the rambling remarks, including his discussion of AI, as hard to follow. Kumagai apologized for his recent X posts, said he would suspend his X account for a period after summarizing the conference, and did not clearly deny resigning.

SecurityITmedia

GMO Chairman Kumagai Delivers "Kumagai-bushi" Even at Tearful Apology Briefing: "In 31 Years, I Have Never Used the Word 'Profit'"

At a briefing on the unauthorized access to GMO Internet Group's "Onamae.com Desktop Cloud" FX auto-trading VPS, Chairman Masatoshi Kumagai said the company will not pay ransom to criminals and described AI-driven changes in cyber threats. He said the industry's pace of change has become "seconds-advancing-minutes," and that the company must shift from a security firm to a resilience firm. Kumagai, 63, said he wants to make the industry a tool for smiles before he dies.

SecurityITmedia

GMO Chairman Kumagai Apologizes Again at Press Conference, Says Social Media Posts "Lacked Consideration"

GMO Internet Group chairman Masatoshi Kumagai held a press conference on November 2 over unauthorized access to the "Onamae.com Desktop Cloud" FX auto-trading VPS and apologized for failing to protect customers. He acknowledged that customer information was leaked, customer assets were damaged, and that a security issue existed, adding that an expert from GMO Cybersecurity by Ierae had pointed out the problem but it was not acted upon. He also apologized again for social media posts that his posts "lacked consideration" for victims.

Securityheise online

Attacks Exploiting Flaws in Drupal, Ivanti Connect Secure and Synology Are Ongoing

Attackers are actively exploiting vulnerabilities in Drupal Commerce Core, Ivanti Connect Secure and Synology DSM to compromise systems, and several organizations have issued warnings. The Drupal flaw allows access control bypass and is being attacked, with fixes in Commerce Core 3.3.13 or 8.x-2.41 and later. Ivanti has issued additional patches for chained flaws, and Synology warns that ransomware gangs are targeting outdated DSM versions that lack fixes from December 2024.