Hackers reportedly hit Ukraine ‘s and Russia ‘s emergency alert apps, sending fake nuclear and attack warnings and raising concerns over public safety.

Ukraine and Russia both said on Sunday night that hackers had compromised their emergency alert apps and used them to send fake warnings about air raids and other attacks, including nuclear threats. The BBC reported the incident, but neither side’s claims have been independently confirmed.

Shortly before 11 p.m. local time (9 p.m. GMT), Ukraine’s widely used Air Alarm app sent the highest-level air raid warnings across the country. Some people, including residents of Kyiv, also received alerts about possible radiation, chemical attacks and street fighting. A message posted on Telegram said the app had likely been targeted by a cyberattack, confirmed there was no radiation threat and urged people to remain calm.

“Shortly before 23:00 local time (21:00 GMT), Ukraine’s widely usedair raid app sent red-level air raid warnings nation-wide, with additional warnings of radiation, chemical attacks, and street fighting sent to some residents in areas including Kyiv.” reports BBC.

“The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel.” an alert on Telegram read.

The false alerts started at about 22:47 with a message that a radiation threat had been declared in Kyiv. At 22:48 came a message in Russian saying a nuclear alert would cover all of Ukraine and not to worry because “it’s Oreshnik flying”. Oreshnik is a Russian intermediate-range ballistic missile that can carry nuclear or conventional warheads, and Russia has the world’s biggest nuclear arsenal, with President Vladimir Putin repeatedly hinting he’s open to using every weapon available.

Two more alerts arrived at 22:49. One, in Ukrainian, warned of a chemical attack on Kyiv and told people not to go outside, and the other said street fighting was taking place in the city. Red, orange and green messages reached phones, and at 23:53 users got all-clear messages, each declaring one of the Kyiv threats over.

A Ukrainian intelligence body, which the BBC calls the Central Intelligence Agency, said there had been a failure in the app and urged people to use other sources of information. It added that the alerts triggered a radiation hazard signal on loudspeakers in the Lviv region, with no real threat.

“The Air Alert app is supported by the Ministry of Digital Transformation of Ukraine, and informs users instantly about the beginning and end of defence alerts. The ministry said it temporarily disabled the app for maintenance after it had “apparently been compromised”. states BBC.

“While the false alerts were quickly contained, cybersecurity experts suggested it was a new line in apparent Russian cyberattacks.”

The temporary shutdown of the Air Alert app also carries significant risks, even if it lasts only a short time. During an outage, users may not receive timely warnings about incoming attacks, leaving them with less time to reach shelters or take protective measures. This is particularly dangerous in a country where missile and drone attacks can happen with little warning.

The incident also highlights a difficult security trade-off: disabling a compromised alert system may prevent attackers from spreading false warnings, but it can temporarily remove a critical channel for delivering real emergency information. Any shutdown therefore needs reliable backup channels, such as sirens, official messaging services and other emergency communication systems.

Regional leaders tried to calm people. Svitlana Onyshchuk, head of the Ivano-Frankivsk region, said everything was calm, even though the app had shown a red-level alert for her region from 22:50 to 23:57. Natalya Zabolotna, her counterpart in Vinnytsia, confirmed a cyberattack on the app and warned people not to click the link in the message, which could be phishing.

Ukraine’s Centre for Countering Disinformation has advice for when the app isn’t working: turn on smartphone notifications, pay attention to sirens, and read only official sources. Oleksander Merezhko, chair of the foreign affairs committee in the Ukrainian parliament and a member of President Zelensky’s Servant of the People party, said the attack caused no panic. Ukrainians, especially in Kyiv, are used to practically non-stop alerts, he told the BBC, and the message in Russian aroused suspicion at once. The attackers picked a language that gave them away.

A few hours later, Russia’s ministry of emergency situations said its own app had suffered “a massive cyberattack” that sent fake information to the public. Ukrainian outlet UNN reported that the hack sent fake nuclear threat alerts inside Russia, citing Atesh, a partisan Ukrainian group operating in Russian-held territory. A screenshot Atesh shared on Telegram, described as purported, claimed nuclear warheads mounted on Ukrainian P1-Sun attack drones had been launched at all regions of Russia, opened with a “risk of getting lively” warning and told residents to stock up on three weeks of food and hide. The alert also had profanities.

Russia said it was still restoring the app but claimed the hack had not affected its wider alert system. It said people could still receive warnings through sirens, loudspeakers, text messages, TV and radio. The false alerts appeared minutes before a local ceasefire in Ukraine’s Kherson region ended on Sunday night. The truce had allowed civilians to leave Russian-occupied Oleshky. Although the fake warnings were quickly stopped, experts see the attack as a worrying escalation.

“I think it’s the first time it’s happened to an official Ukrainian information app, but I suspect it won’t be the last,” Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told BBC World Service’s Newsday programme.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ukraine)

Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings.

Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The attackers have watched the live video, changed device settings and created accounts of their own. The alert doesn’t say who was targeted or how many devices are affected.

The attackers abused Easy4IP, Dahua’s cloud feature that lets users access devices remotely. When this feature is enabled, the camera or recorder connects to Dahua’s cloud and registers using its serial number. Anyone who knows the serial number may be able to access the device through the cloud, without needing an open port or a public IP address. This means the connection can bypass the protection normally provided by a router’s firewall.

As a result, a camera that isn’t directly exposed to the internet may still be at risk. CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet.

“The main vector is the P2P/cloud access function (Easy4IP). The device independently initiates an outgoing connection to the manufacturer’s cloud infrastructure and registers in it by serial number. Access to the device is then established via the cloud by serial number, bypassing NAT and firewall, without published ports and a “white” IP address.” reads the report published by CERT-UA. “Thus, the lack of direct access from the Internet does not guarantee the security of the device with the active P2P function.”

Serial numbers follow predictable patterns, so attackers may be able to guess them automatically and check which devices are registered in the cloud. Simply keeping a serial number private isn’t enough to ensure security.

Once attackers connect to a device, they need to get past its login. They may try common or weak passwords or exploit security flaws in outdated firmware, especially CVE-2021-33044 and CVE-2021-33045. These two vulnerabilities allow attackers to bypass authentication without a password, so even a strong password won’t protect a device running vulnerable firmware.

There are three signs that a device may have been compromised. First, look for accounts you don’t recognize. Second, check for changed settings, including text added over the video image. However, the absence of these labels does not mean the device is safe. Third, check the audit logs for logins using Dahua’s DVRIP protocol from the local address 127.0.0.1, which can indicate access through the cloud service.

CERT-UA recommends four steps:

1. Turn off P2P and cloud access if you don’t use it.
2. Keep cameras off the internet. For remote access, use a VPN and allow only authorized IP addresses.
3. Check the account list for ones you didn’t create, and check which cloud accounts are linked to the device and disconnect unknown ones.
4. Update the software by hand to the latest version, and set up a regular update routine.

CERT-UA advises organizations that detect signs of unauthorized access to report them to cert@cert.gov.ua and check all Dahua devices on their networks, including those that may have been forgotten. The agency warns that all devices with active P2P functionality are at risk.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, IP cameras)

A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space.

A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine. CNN reports it may have come within less than a mile. Orbital monitoring company LeoLabs says the behavior is consistent with rendezvous and proximity operations, meaning maneuvers designed to bring two spacecraft together.

“A rare move by a Russian-made satellite may have brought it within less than a mile of a commercial Earth-observation satellite that may be used to provide national security services to countries such as Ukraine.” states CNN.

“It’s not clear what, exactly, the Russian satellite, called Kosmos 2612 or Cosmos 2612, intended to accomplish with its close approach. But the behavior was consistent with rendezvous and proximity operations, or maneuvers carried out in orbit that are designed to bring two spacecraft together, said orbital monitoring services company LeoLabs, which tracks space junk and activity in Earth orbit, in a statement.”

It is unclear what Russia wanted to achieve. LeoLabs said “While the intent remains uncertain, the behavior warrants continued monitoring.” Astrophysicist Jonathan McDowell noted that this could be the first known case of one spacecraft approaching another without permission. This is different from docking, when two spacecraft intentionally connect, a common practice in space.

The events unfolded over several months. In May, four Russian-controlled satellites changed their orbits to align with ICEYE-X36, according to a June report by the Royal United Services Institute. On October 15, Kosmos 2612 began moving closer to ICEYE-X36, reducing the distance from 350 kilometers to less than 5 kilometers by early October 16. It stayed nearby, making small adjustments through the weekend, before starting to move away on Monday. The War Zone (TWZ) reports that Kosmos 2612 was one of six satellites launched together on April 17.

The closest point is disputed. LeoLabs says it came within roughly 500 meters during part of the event, but warns that the repeated maneuvers and awkward tracking geometry make separation estimates uncertain. Space.com reports the satellites may have been a few meters apart at one point, and TWZ’s reading of public tracking data points to about 26 meters.

The target matters. ICEYE operates about 80 radar satellites that image the Earth through clouds, day and night, and ICEYE-X36 belongs to its US subsidiary. At least some ICEYE satellites provide imagery to Ukraine, and in January the company signed a contract firming up that relationship, saying it gives Ukraine’s Ministry of Defence persistent situational awareness on tactical timelines. A Ukrainian official told Axios that Ukraine’s military works with ICEYE but couldn’t say whether this specific satellite is involved.

Russia appears to be paying close attention to ICEYE-X36. Changing a satellite’s orbit to match another spacecraft’s path uses a lot of fuel, so it is not a decision taken lightly. Four Russian satellites made similar changes in May. However, it remains unclear whether ICEYE-X36 is specifically used to collect images of Ukraine.

Close approaches between satellites are not new, but this case is different. Russia, the United States, and China have all moved satellites close to those operated by other countries, mainly in geostationary orbit. Kosmos 2612 operates in low Earth orbit. As far as is publicly known, Russia has carried out similar approaches there, but the United States and China have not.

Victoria Samson of the Secure World Foundation pointed to two earlier Russian cases. In 2020, Kosmos 2543 came within about 30 kilometers of USA 245. In 2022, Kosmos 2558 approached USA 326 to within about 70 kilometers.

Both targets were classified US spy satellites operated by the National Reconnaissance Office. ICEYE-X36, by contrast, is a privately owned satellite, and Kosmos 2612 came much closer than in those earlier cases. Space law professor Aaron Brynildson told Axios that there is no strict legal limit on how close satellites can approach each other. However, countries generally avoid getting within six miles of another satellite.

Why do it? Samson lists a few options. Russia may want to learn the satellites’ capabilities and what they’re studying, or it may have interfered with sensors or communications. She leans toward a different reading: she thinks Russians are getting frustrated, in a stalemate for about six months, and this is a way to show military prowess in a way Ukraine can’t answer, since Ukraine matches Russia in drones but not in space.

RUSI’s June report is blunter about the options. It lists intimidation or interference through jamming, which uses radio noise to stop satellites from communicating. It adds that the range of options for protecting an ICEYE satellite is limited, and that defending satellites is a famous dilemma. LeoLabs says the event doesn’t establish hostile intent, but shows capabilities that could support intelligence collection, inspection, coercive signaling, interference or preparation for future counterspace operations.

ICEYE’s response was short: the company is aware, tracking closely, and says its constellation architecture is designed for continuity and resilience. CNN says it asked Russia’s defense ministry and Roscosmos for comment. The US Space Force had already described Russian satellites positioned near a Western commercial radar satellite used by Ukraine for imagery intelligence, according to Axios.

Private companies and independent observers, rather than the US Space Force, revealed the satellite encounter, highlighting the need for greater government transparency as space becomes more contested.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, satellite)

Italy’s Foreign Ministry is defending its website against a cyberattack, checking embassy sites and pushing for EU action to identify attackers.

On the morning of October 8, Italy’s Ministry of Foreign Affairs said its website was being attacked. According to the ministry’s own statement, its protection systems have mitigated the attack so far, with no disruption. The statement doesn’t say who is behind it, or what kind of attack it is.

The ministry is monitoring the situation with the Polo Strategico Nazionale, the country’s national cloud hub, and with the competent authorities.

“Cybersecurity is a central element of the reform of the Foreign Ministry approved last year. In recent months, we have strengthened our capabilities to prevent, monitor and respond to threats, adopting all necessary countermeasures, including on the technological side,” Foreign Minister Antonio Tajani said.

“Tajani had also had the opportunity to explain the technical capabilities of the CSIRT Operations Room to German Foreign Minister Johann Wadephul during his recent visit to Rome.” “In this context, Italy has decided to work with Romania and other EU member states to include proposals in upcoming European meetings to designate the actors responsible for cyberattacks, including attacks targeting Italian institutions.” reads the statement published by Italy’s Foreign Ministry.

Analysts are also checking the websites of Italian embassies and consulates abroad for similar attempts. That detail matters, and I’ll come back to it.

Minister Antonio Tajani tied the response to last year’s reform of the Farnesina, which made cybersecurity a central piece. He said prevention, monitoring and response capabilities have been strengthened in recent months, including on the technology side.

The statement ends on diplomacy. Italy will work with Romania and other member states to put proposals on the agenda of upcoming EU meetings, aimed at naming those responsible for cyberattacks, including attacks on Italian institutions. A blocked page is forgotten in a day, while a name on an official list is harder to shrug off.

Nobody has claimed this attack, but the pattern is familiar. NoName057(16) is a pro-Russian group that declared itself in March 2022 and announces its targets on Telegram. Avast researchers saw it using the Bobik botnet for DDoS attacks as early as September 2022.

Later, the DDoSia Project (aka DDosia), a crowdsourced DDoS operation linked to the pro-Russian hacktivist group NoName057(16), made the headlines beacuse its involvement in DDoS attacks again governments that supported Ukraine.

Italy has been a regular target. Over a weekend in January 2025, as Zelensky visited Rome, the group hit ministries and government sites on Saturday, then banks including Intesa and Monte dei Paschi di Siena and the ports of Taranto and Trieste on Sunday. At the end of December 2024 it had gone after Malpensa and Linate airports, and in February 2025 it tied a new wave to a speech by President Mattarella, according to Infosecurity Magazine. The timing follows politics, which isn’t a coincidence.

The ministry itself has been here before. ANSA reported that Russian hackers took its website down in late December 2024, and Tajani said it was back up the next day. DDoS attacks hit availability, not data, so the site goes dark and comes back. A loud attack can also pull attention away from a quiet one, which is a reason to look closer, not a claim about this case.

Now the embassies, and this part is my analysis. A ministry homepage going dark is embarrassing. An embassy or consulate site going dark is a problem for real people, because it’s where citizens abroad look for appointments, contacts and instructions, and the worst moment for an outage is a crisis abroad. Every one of those sites is also a surface to defend, and a lookalike page is an easy way to scam someone who’s already stressed.

Giving a look to the list of targets shared on DDosia today I can confirm that administrators planned attacks against the Farnesina, five Italian embassy sites, several Interior and Defence Ministry services, and other Italian organizations.

• attiva.fastweb.it
• sind.it
• whs.activenetwork.it
• bp.activenetwork.it
• sistemagalileo.it
• www.activenetwork.it
• webtop.we-com.it
• www.fastweb.it
• agenzie.interno.gov.it
• ambbruxelles.esteri.it
• ambbucarest.esteri.it
• ambcopenaghen.esteri.it
• ambdublino.esteri.it
• ambhelsinki.esteri.it
• concorsi.difesa.it
• constoronto.esteri.it
• idserver.servizicie.interno.gov.it
• sondaggi.bimedia.it
• www.aeronautica.difesa.it
• www.cartaidentita.interno.gov.it
• www.esteri.it
• www.giorgiameloni.it
• www.istitutospiov.it
• www.marina.difesa.it
• www.prenotazionicie.interno.gov.it
• www.uni.com

There is a precedent. In 2017, The Guardian reported a months-long intrusion into the Foreign Ministry’s systems. Italian media later reported that the attackers had targeted staff email accounts at the ministry and Italian embassies, rather than the encrypted system used for sensitive communications. A senior ministry security official said that attacks often happen before important events for Italy, while the Kremlin denied any involvement.

That’s why checking embassy websites is more than routine work. If someone wants to damage Italy’s image at little cost, the diplomatic network offers a large and highly visible target. The ministry is responding by strengthening its technical defenses and pushing at the EU level for “proposals to designate actors responsible for cyber attacks”, as the Farnesina’s statement puts it. That could make attribution more costly for attackers than simply taking a website offline.

DDoS attacks should not be underestimated, especially when they target government institutions and diplomatic services. They can disrupt public services, create pressure and attract significant media attention. But from a technical perspective, they are not usually complex offensive operations for a state to neutralize, especially when the target has adequate DDoS protection and network capacity.

The more important question is what sits behind the noise. Authorities need to determine whether these attacks are simply disruptive actions designed to attract attention, or whether they are being used to distract defenders while more sophisticated operations take place elsewhere. If there is no evidence of intrusion, data theft or compromise, the DDoS activity may be little more than a public demonstration of intent.

That distinction matters because a long list of targets can create the impression of a much more serious threat than the technical impact actually suggests. For people outside the cybersecurity community, a website being attacked can easily be interpreted as evidence that a government has been seriously compromised. In reality, it may be a relatively simple operation whose main objective is visibility.

The risk, therefore, is not only the attack itself, but the narrative built around it. DDoS campaigns can become a useful propaganda tool, creating fear and uncertainty while requiring relatively limited technical resources. The challenge for governments is to defend against the disruption without giving a sterile attack more strategic value than it deserves, while at the same time making sure that the noise is not hiding something more serious.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Italy’s Foreign Ministry)

DOJ charges against Oxygen Forensics reveal the Russian-linked firm also sold forensic software to EU projects and European police forces for years.

Last week’s Justice Department indictment of Oxygen Forensics looked, at first, like an American procurement scandal. CEO Lee Reiber and Russian co-founder Oleg Davydov stand accused of hiding that the company was Russian-owned and its software built in Russia, while it sold forensic tools to the Pentagon, the Secret Service, and other US agencies. Politico’s reporting shows the reach went a lot further than Washington.

“The CEO of a Virginia-based software company and a Russian national have been arrested on a federal criminal complaint charging them with concealing from U.S. government agencies that their company was owned and controlled by Russian nationals and that its software was developed in Russia, the Justice Department announced today.” DoJ states. “Reiber allegedly represented to the government that the company had no foreign ownership or control and that its software was developed in the United States, when in fact five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia.”

According to documents reviewed by Politico, Oxygen Forensics was involved in two EU-funded projects designed to improve how European investigators collect and share digital evidence.

The first, EVIDENCE, ran from 2014 to 2016 and received more than €1.9 million in EU funding. Oxygen was consulted alongside organizations such as Europol, Eurojust and the European Anti-Fraud Office’s digital forensics unit.

The second project, INSPECTr, was funded through Horizon 2020. It developed software that allowed investigators to combine evidence extracted with tools such as Oxygen’s with data from other systems. The project continued until 2023, after Russia’s invasion of Ukraine.

“The second project, INSPECTr, backed under Horizon 2020, an EU research and innovation funding arm, was designed to help European police bring together and analyze digital evidence collected using different tools. It built software that could take evidence extracted with Oxygen Forensics and make it easier for investigators using other systems to access and analyze it.” reports POLITICO. “Although both of those EU-backed projects were launched well before Russia’s February 2022 full-scale invasion of Ukraine and subsequent European sanctions, INSEPCTr continued to operate until 2023.”

The European Commission said Oxygen was not a formal member of either consortium and did not receive direct EU funding. It also noted that Russian entities have been excluded from Horizon Europe projects since the war began.

That may be technically correct, but the issue is broader: Oxygen was still consulted on EU-funded projects dealing with digital evidence and investigative technology, even if it was not officially part of the project or directly funded by the EU.

The domestic Russian side of this story is the part that should worry European agencies more than the funding technicality does. The same five people who secretly owned Oxygen Forensics also controlled MKO Systems, a Russian company selling the same underlying technology to the FSB and Russia’s Interior Ministry. That’s not two unrelated businesses that happen to share a founder. That’s one piece of forensic technology with two sets of customers who are, depending on how you look at it, on opposite sides of several ongoing investigations.

And the client list in Europe, once you start counting, is long. Police agencies in Germany, Spain, Italy, and Poland accredited or purchased Oxygen’s products, according to EU tender records. Hungary’s police signed a contract worth roughly €27,000 in December 2024, running through the end of last year. A prosecutor’s office in Sardinia listed Oxygen among its recognized mobile-extraction systems as recently as April 2026, and a Spanish National Police inspector accredited by the company co-authored a 2026 study on cracking WhatsApp data on Android and iPhone. Romania and Latvia bought in as recently as this September, days before the arrests.

There is also a more worrying case outside the EU. French outlet Disclose reported that Oxygen’s software was provided to Moroccan authorities through an EU-funded border management program covering the Maghreb. The EU also paid for training courses where Oxygen employees trained Moroccan police to use the software.

In other words, a tool allegedly controlled by Russian interests was being used to train foreign law enforcement, with the training funded by the EU.

Some agencies are now reacting. Romania’s National Anticorruption Directorate told Politico it will stop using Oxygen’s products after the ownership issue became public. However, this does not change any data that may already have been extracted using the software.

Other national police agencies contacted by Politico did not respond.

“In December 2022 and October 2023, Reiber falsely certified to the U.S. government that Oxygen Forensics had no immediate or highest-level owner. According to the affidavit, in November 2023, a reporter asked Reiber about Oxygen Forensics’ ownership and its connection to the Russian company.” continues DoJ. “Reiber then wrote to Davydov and two other Russian owners that public reporting on the connection “could destroy this entire opportunity,” referring to a pending contract with the National Computer Forensics Institute, and that the “current existence of this company hangs in the balance.””

Natalia Krapiva at Access Now put the stakes about as plainly as they can be put: civil society groups had flagged Oxygen’s Russian links for years, and this case just confirmed what they’d been saying.

“If in fact Russian-made software designed for the FSB and Investigative Committee was used for handling EU Commission criminal evidence database, it raises a serious possibility of sensitive information being compromised and accessed by Russian authorities,” Krapiva told Politico. “We call on the EU and every government using these tools to suspend them and fully investigate how a Russian-owned company spent a decade inside Western law enforcement.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Oxygen Forensics)