Russian EMERCOM hacked: users were sent a fake alert about nuclear warhead launch

On the night of 2 November, an incident involving the mobile application of the Ministry of Emergency Situations (EMERCOM) was recorded in Russia. Users received false notifications claiming that nuclear warheads had allegedly been launched across all regions of the country. This event occurred against the backdrop of a previous attack on the Ukrainian service "Air Alert", although a direct link between the two hacks has not yet been confirmed.

False warning of nuclear threat

Residents of Russia received a message with the headline "Threat of a happening". The text claimed that nuclear warheads had been launched across the entire territory of the country. Recipients were urged to immediately take shelter in basements and stock up on food for three weeks. The distribution was accompanied by profanity and mocking phrasing.

According to media reports, similar publications also appeared in a number of regional EMERCOM channels and operational headquarters. Later, some of these messages were deleted. It is worth noting that the phrase about a strike "across all regions" was part of the text of the fake distribution, and did not reflect the actual geographical scope of the attack.

Response from Russian authorities

The Russian Federation's emergency services department acknowledged the fact of a cyberattack on its mobile application. EMERCOM reported that the perpetrators managed to spread false information. At present, specialists are working to eliminate the vulnerability and restore the normal operation of the service.

The department assures that the hack did not affect the main channels for alerting the population, such as sirens, loudspeakers, SMS broadcasts, as well as television and radio broadcasting. The mobile application is characterised there as an auxiliary tool. Thus, the confirmed failure relates exclusively to the protection of this specific app; there is no data on the compromise of the entire alert system.

Link to the attack on "Air Alert"

The incident attracted attention due to the chronology of events. On the evening of 1 November, the day before the hack of the Russian service, the Ukrainian app "Air Alert" also began sending false messages. Users received notifications about radiation and chemical hazards, street fighting, and other threats. The development team confirmed unauthorised interference and temporarily suspended the operation of the service.

The temporal proximity of these events gives grounds to assume that the attack on Russian EMERCOM could have been a retaliatory reaction. However, temporal proximity alone is not proof of a common plan or a motive for revenge. Verified sources currently have no confirmation of the identity of the organisers of the Russian hack or their connection to the Ukrainian incident.

Vulnerability of state service protection

This attack demonstrated a specific vulnerability in the protection of the Russian state application: third parties managed to use it to send false warnings. The consequence of such interference could be the undermining of public trust in future messages about real dangers.

Recall that it was previously reported that more than 100 Ukrainian websites had been hacked. According to CERT-UA, the perpetrators used a fake "I am not a robot" check to prompt visitors to run malicious commands on their computers.

There is also mention of a case where the StopKor editorial team repelled a large-scale DDoS attack. At that time, technical specialists recorded over half a billion malicious requests and strengthened the protection of the resource.