Hacked sirens: fake radiation and nuclear alerts hit Ukraine and Russia as the Kherson truce ends

The night the phones lied to Kyiv

At approximately 22:47 local time on Sunday, November 1, 2026, mobile phones across Ukraine began screaming warnings that were never real. The country’s Air Alarm app, the tool millions rely on for real-time warnings of Russian air attacks, issued a red-level alert declaring a radiation threat in Kyiv. Within the hour came fabricated nuclear, chemical and street-fighting warnings. All-clear messages arrived at 23:53, but public confidence was already damaged.

Ukraine’s Air Force moved fast to contain the panic: “The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel,” it wrote on Telegram. Spokesman Yuriy Ignat later confirmed to AFP that the app had been hacked, and SPRAVDI, Ukraine’s Centre for Strategic Communications, blamed Russia in a post on X.

Hours later came the mirror image. Early Monday, Russia’s Emergencies Ministry said on Telegram that its emergency-warnings app, which alerts Russians to drone attacks, had suffered a “massive cyberattack” letting attackers send “false information to the public”. No culprit was named; TASS reported restoration work under way. Ukrainian outlet UNN reported false nuclear-threat warnings reaching users inside Russia, and the partisan group Atesh claimed responsibility on Telegram, sharing a screenshot of a purported alert telling users to stock three weeks of provisions and shelter in basements.

The twin incidents landed the exact night a rare pause in the fighting died. The localised Kherson ceasefire, brokered by US First Lady Melania Trump and in effect from October 27 to November 1, ended Sunday after Russia refused an extension, according to Kyiv; closing what Al Jazeera called the longest truce of the war and reopening the front around the humanitarian mission to Oleshky.

The BBC reconstructed the sequence from the Air Force’s Telegram channel: at 22:47 (20:47 GMT), in Ukrainian, “Radiation threat. Radiation threat declared in Kyiv.” At 22:48, in Russian: “Hi! There will be a nuclear alert across Ukraine. Don’t worry, it’s Oreshnik flying.” At 22:49, two more in Ukrainian; a chemical-threat warning and a street-fighting warning, both telling Kyiv residents not to go outside.

The timeline both capitals confirm

The Ukrainian sequence is documented to the minute: fake alerts from 22:47, four fabricated warnings, radiation, nuclear, chemical, street fighting, and all-clear messages at 23:53. The Air Force’s Telegram statement, Ignat’s confirmation to AFP, and the Central Intelligence Agency’s advisory to use alternative sources are all on the record. Ukraine’s Digital Transformation ministry added that the nationwide alert system kept operating normally, and Kyiv authorities said the capital’s separate dedicated app was never affected.

On the Russian side, the Emergencies Ministry’s early-Monday Telegram post is the primary record: a “massive cyberattack”, “false information” pushed to the public, restoration under way. TASS corroborated the scale; UNN’s report of false nuclear warnings inside Russia and Atesh’s Telegram claim complete the picture as reported across eastern and western outlets.

The night’s wider context is equally documented. The Kherson truce ran October 27 to November 1, five days, the longest pause of the war, and governor Oleksandr Prokudin had warned residents to heed warnings the moment it lapsed. That same Sunday, Russia reported a drone strike on an industrial enterprise east of Moscow, Ukrainian media said Kyiv hit the Kstovo oil refinery, and Ukraine’s energy ministry reported fresh blackouts, including in Kyiv. Zelenskyy offered on Fox News to stop the refinery strikes for Patriot missiles, while Trump presses Kyiv to halt them over diesel costs tied to the US-Israel war with Iran. Two details remain single-sourced: Fox News’ report, via Gulf News, of compromised Kyiv loudspeakers, and ABP News’ report of the radiation signal on Lviv-region loudspeakers.

Attribution is the hole in the middle

No one has produced forensic evidence naming the intruders. SPRAVDI blames Russia for the Ukrainian-app hack; Atesh claims the Russian-app breach; Moscow’s ministry names no one. Those are accusations and a claim, not proof; and the Bureau treats them as such. Whether the two breaches were one coordinated operation, two opportunistic strikes riding the same chaotic night is unknown.

The technical vector is undisclosed on both sides: no authority has said how the apps were entered; back end, push-notification provider, or upstream feed. Russia has given no restoration timeline; Ukraine has not identified the weak point in the Air Alarm pipeline, nor confirmed whether the Kyiv and Lviv loudspeaker reports describe a real second intrusion or a rumor amplified in a chaotic hour. Unresolved is intent: a radiation-and-nuclear scare aimed at Kyiv reads as psychological warfare, a mirrored strike as retaliation; real or claimed. Until forensics surface, the honest answer is: not established.

Warning systems only work if people believe them

In the fifth year of Russia’s full-scale invasion, the air-raid app is civil defence, not convenience. Millions of Ukrainians decide whether to shelter, whether to keep the metro open as a refuge, based on what that app says. Sunday night taught them a corrosive lesson: the phone can lie. The next genuine warning will meet hesitation; and hesitation during a real strike is measured in lives. Officials spent the night insisting the fake alerts were fake and the real system still worked: they were fighting the erosion of the one reflex the home front cannot lose.

The Russian side of the ledger matters in reverse. An emergency app convertible into a loudspeaker for “false information”, including, if UNN’s report holds, fake nuclear-threat warnings, hands any future attacker a ready-made panic machine aimed at Russian civilians. Moscow’s silence avoids admitting vulnerability; Kyiv’s instant blame is information warfare. Neither posture produces the one thing that would help: a credible technical account of what broke. Civilian alert infrastructure, like the French supermarket systems hit by an earlier disruptive cyberattack, is now a deliberate target set in this war.

A psyop dressed as a cyberattack

Read through the 5D lens, Sunday night was a psychological-operations story using hacking as its delivery vehicle. The geopolitical dimension is the timing: the intrusions began within hours of the Kherson truce’s expiry. Whoever ordered the Ukrainian-app intrusion chose the four horsemen of civilian terror, radiation, nuclear, chemical, street combat, and scripted the Oreshnik reference to invoke Russia’s most feared missile by name. That is audience design, not vandalism. The logic is asymmetry: compromising a push-notification pipeline is cheap, the panic it buys enormous.

Historically, the mirror pattern is the tell. Paired, same-night intrusions suggest three architectures: a single actor running a two-sided chaos operation; two independent actors exploiting the same night; or one real attack plus one opportunistic claim; Atesh has every incentive to claim a hack it only watched. The war’s record, from grid intrusions to satellite-terminal disruptions, says cyberspace is now a fully integrated warfighting domain.

Why did both sides’ warning systems fail on the same night?

Both systems likely share one structural weakness: civilian alert apps are built for speed and reach, not adversarial resistance. They ingest threat data from central feeds, push it to millions of devices through commercial infrastructure, and authenticate content weakly; because every verification layer is a second of delay, and delay kills during a missile raid.

What breaks after the alerts go quiet

First, both states will harden their alert pipelines; stronger authentication, segmented feeds, manual release gates for the most alarming messages. Each fix trades speed for safety: a warning delayed by verification arrives after the blast. Hardening also means centralisation, and centralised alert control in wartime sits one step from alert control as domestic information management.

Second, the doctrine spreads. Sunday night proved civilian warning infrastructure is high-leverage, and militaries learn fast. Expect the cyber front to shift toward the systems ordinary people touch; banking apps, transport signage, broadcast emergency channels. The Atesh claim, true or not, normalises a new genre: partisan groups claiming strategic cyber effects on Telegram, with screenshots as evidence and virality as verification.

Third, diplomacy absorbs the shock. US-mediated talks are set to resume this month after freezing since February’s joint strikes on Iran; and they will resume against a background of mutual accusations over the night’s hacks. Each side arrives with a fresh grievance and a fresh reason to distrust the other. A war in which even the air-raid sirens are contested is a war whose de-escalation needs verification mechanisms that do not yet exist.

The forensics both sides will not publish

Watch for what is not said. Neither Kyiv nor Moscow has promised a public forensic report, and this war’s pattern suggests none will come: attribution evidence is intelligence, and intelligence stays classified. What surfaces instead is posture; retaliatory cyber operations, quiet or claimed, in the coming days. If Atesh’s claim is genuine, Moscow will treat it as Ukrainian state action; if theatre, Kyiv will let the ambiguity work.

Kinetically, the truce’s end has already restarted the exchange: the reported Kstovo refinery strike and the Russian energy strikes that blacked out parts of Kyiv on Sunday are the shape of the coming weeks. Zelenskyy’s Fox News offer, no more refinery strikes for Patriot missiles, puts the next move on Washington. On the information front, the question is whether Ukrainians and Russians keep trusting the apps in their pockets. The next real alert is the test; and the hackers, whoever they were, will be watching the response as closely as the air forces.