Hackers reportedly hit Ukraine ‘s and Russia ‘s emergency alert apps, sending fake nuclear and attack warnings and raising concerns over public safety.

Ukraine and Russia both said on Sunday night that hackers had compromised their emergency alert apps and used them to send fake warnings about air raids and other attacks, including nuclear threats. The BBC reported the incident, but neither side’s claims have been independently confirmed.

Shortly before 11 p.m. local time (9 p.m. GMT), Ukraine’s widely used Air Alarm app sent the highest-level air raid warnings across the country. Some people, including residents of Kyiv, also received alerts about possible radiation, chemical attacks and street fighting. A message posted on Telegram said the app had likely been targeted by a cyberattack, confirmed there was no radiation threat and urged people to remain calm.

“Shortly before 23:00 local time (21:00 GMT), Ukraine’s widely usedair raid app sent red-level air raid warnings nation-wide, with additional warnings of radiation, chemical attacks, and street fighting sent to some residents in areas including Kyiv.” reports BBC.

“The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel.” an alert on Telegram read.

The false alerts started at about 22:47 with a message that a radiation threat had been declared in Kyiv. At 22:48 came a message in Russian saying a nuclear alert would cover all of Ukraine and not to worry because “it’s Oreshnik flying”. Oreshnik is a Russian intermediate-range ballistic missile that can carry nuclear or conventional warheads, and Russia has the world’s biggest nuclear arsenal, with President Vladimir Putin repeatedly hinting he’s open to using every weapon available.

Two more alerts arrived at 22:49. One, in Ukrainian, warned of a chemical attack on Kyiv and told people not to go outside, and the other said street fighting was taking place in the city. Red, orange and green messages reached phones, and at 23:53 users got all-clear messages, each declaring one of the Kyiv threats over.

A Ukrainian intelligence body, which the BBC calls the Central Intelligence Agency, said there had been a failure in the app and urged people to use other sources of information. It added that the alerts triggered a radiation hazard signal on loudspeakers in the Lviv region, with no real threat.

“The Air Alert app is supported by the Ministry of Digital Transformation of Ukraine, and informs users instantly about the beginning and end of defence alerts. The ministry said it temporarily disabled the app for maintenance after it had “apparently been compromised”. states BBC.

“While the false alerts were quickly contained, cybersecurity experts suggested it was a new line in apparent Russian cyberattacks.”

The temporary shutdown of the Air Alert app also carries significant risks, even if it lasts only a short time. During an outage, users may not receive timely warnings about incoming attacks, leaving them with less time to reach shelters or take protective measures. This is particularly dangerous in a country where missile and drone attacks can happen with little warning.

The incident also highlights a difficult security trade-off: disabling a compromised alert system may prevent attackers from spreading false warnings, but it can temporarily remove a critical channel for delivering real emergency information. Any shutdown therefore needs reliable backup channels, such as sirens, official messaging services and other emergency communication systems.

Regional leaders tried to calm people. Svitlana Onyshchuk, head of the Ivano-Frankivsk region, said everything was calm, even though the app had shown a red-level alert for her region from 22:50 to 23:57. Natalya Zabolotna, her counterpart in Vinnytsia, confirmed a cyberattack on the app and warned people not to click the link in the message, which could be phishing.

Ukraine’s Centre for Countering Disinformation has advice for when the app isn’t working: turn on smartphone notifications, pay attention to sirens, and read only official sources. Oleksander Merezhko, chair of the foreign affairs committee in the Ukrainian parliament and a member of President Zelensky’s Servant of the People party, said the attack caused no panic. Ukrainians, especially in Kyiv, are used to practically non-stop alerts, he told the BBC, and the message in Russian aroused suspicion at once. The attackers picked a language that gave them away.

A few hours later, Russia’s ministry of emergency situations said its own app had suffered “a massive cyberattack” that sent fake information to the public. Ukrainian outlet UNN reported that the hack sent fake nuclear threat alerts inside Russia, citing Atesh, a partisan Ukrainian group operating in Russian-held territory. A screenshot Atesh shared on Telegram, described as purported, claimed nuclear warheads mounted on Ukrainian P1-Sun attack drones had been launched at all regions of Russia, opened with a “risk of getting lively” warning and told residents to stock up on three weeks of food and hide. The alert also had profanities.

Russia said it was still restoring the app but claimed the hack had not affected its wider alert system. It said people could still receive warnings through sirens, loudspeakers, text messages, TV and radio. The false alerts appeared minutes before a local ceasefire in Ukraine’s Kherson region ended on Sunday night. The truce had allowed civilians to leave Russian-occupied Oleshky. Although the fake warnings were quickly stopped, experts see the attack as a worrying escalation.

“I think it’s the first time it’s happened to an official Ukrainian information app, but I suspect it won’t be the last,” Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told BBC World Service’s Newsday programme.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ukraine)

Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings.

Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The attackers have watched the live video, changed device settings and created accounts of their own. The alert doesn’t say who was targeted or how many devices are affected.

The attackers abused Easy4IP, Dahua’s cloud feature that lets users access devices remotely. When this feature is enabled, the camera or recorder connects to Dahua’s cloud and registers using its serial number. Anyone who knows the serial number may be able to access the device through the cloud, without needing an open port or a public IP address. This means the connection can bypass the protection normally provided by a router’s firewall.

As a result, a camera that isn’t directly exposed to the internet may still be at risk. CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet.

“The main vector is the P2P/cloud access function (Easy4IP). The device independently initiates an outgoing connection to the manufacturer’s cloud infrastructure and registers in it by serial number. Access to the device is then established via the cloud by serial number, bypassing NAT and firewall, without published ports and a “white” IP address.” reads the report published by CERT-UA. “Thus, the lack of direct access from the Internet does not guarantee the security of the device with the active P2P function.”

Serial numbers follow predictable patterns, so attackers may be able to guess them automatically and check which devices are registered in the cloud. Simply keeping a serial number private isn’t enough to ensure security.

Once attackers connect to a device, they need to get past its login. They may try common or weak passwords or exploit security flaws in outdated firmware, especially CVE-2021-33044 and CVE-2021-33045. These two vulnerabilities allow attackers to bypass authentication without a password, so even a strong password won’t protect a device running vulnerable firmware.

There are three signs that a device may have been compromised. First, look for accounts you don’t recognize. Second, check for changed settings, including text added over the video image. However, the absence of these labels does not mean the device is safe. Third, check the audit logs for logins using Dahua’s DVRIP protocol from the local address 127.0.0.1, which can indicate access through the cloud service.

CERT-UA recommends four steps:

1. Turn off P2P and cloud access if you don’t use it.
2. Keep cameras off the internet. For remote access, use a VPN and allow only authorized IP addresses.
3. Check the account list for ones you didn’t create, and check which cloud accounts are linked to the device and disconnect unknown ones.
4. Update the software by hand to the latest version, and set up a regular update routine.

CERT-UA advises organizations that detect signs of unauthorized access to report them to cert@cert.gov.ua and check all Dahua devices on their networks, including those that may have been forgotten. The agency warns that all devices with active P2P functionality are at risk.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, IP cameras)

A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space.

A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine. CNN reports it may have come within less than a mile. Orbital monitoring company LeoLabs says the behavior is consistent with rendezvous and proximity operations, meaning maneuvers designed to bring two spacecraft together.

“A rare move by a Russian-made satellite may have brought it within less than a mile of a commercial Earth-observation satellite that may be used to provide national security services to countries such as Ukraine.” states CNN.

“It’s not clear what, exactly, the Russian satellite, called Kosmos 2612 or Cosmos 2612, intended to accomplish with its close approach. But the behavior was consistent with rendezvous and proximity operations, or maneuvers carried out in orbit that are designed to bring two spacecraft together, said orbital monitoring services company LeoLabs, which tracks space junk and activity in Earth orbit, in a statement.”

It is unclear what Russia wanted to achieve. LeoLabs said “While the intent remains uncertain, the behavior warrants continued monitoring.” Astrophysicist Jonathan McDowell noted that this could be the first known case of one spacecraft approaching another without permission. This is different from docking, when two spacecraft intentionally connect, a common practice in space.

The events unfolded over several months. In May, four Russian-controlled satellites changed their orbits to align with ICEYE-X36, according to a June report by the Royal United Services Institute. On October 15, Kosmos 2612 began moving closer to ICEYE-X36, reducing the distance from 350 kilometers to less than 5 kilometers by early October 16. It stayed nearby, making small adjustments through the weekend, before starting to move away on Monday. The War Zone (TWZ) reports that Kosmos 2612 was one of six satellites launched together on April 17.

The closest point is disputed. LeoLabs says it came within roughly 500 meters during part of the event, but warns that the repeated maneuvers and awkward tracking geometry make separation estimates uncertain. Space.com reports the satellites may have been a few meters apart at one point, and TWZ’s reading of public tracking data points to about 26 meters.

The target matters. ICEYE operates about 80 radar satellites that image the Earth through clouds, day and night, and ICEYE-X36 belongs to its US subsidiary. At least some ICEYE satellites provide imagery to Ukraine, and in January the company signed a contract firming up that relationship, saying it gives Ukraine’s Ministry of Defence persistent situational awareness on tactical timelines. A Ukrainian official told Axios that Ukraine’s military works with ICEYE but couldn’t say whether this specific satellite is involved.

Russia appears to be paying close attention to ICEYE-X36. Changing a satellite’s orbit to match another spacecraft’s path uses a lot of fuel, so it is not a decision taken lightly. Four Russian satellites made similar changes in May. However, it remains unclear whether ICEYE-X36 is specifically used to collect images of Ukraine.

Close approaches between satellites are not new, but this case is different. Russia, the United States, and China have all moved satellites close to those operated by other countries, mainly in geostationary orbit. Kosmos 2612 operates in low Earth orbit. As far as is publicly known, Russia has carried out similar approaches there, but the United States and China have not.

Victoria Samson of the Secure World Foundation pointed to two earlier Russian cases. In 2020, Kosmos 2543 came within about 30 kilometers of USA 245. In 2022, Kosmos 2558 approached USA 326 to within about 70 kilometers.

Both targets were classified US spy satellites operated by the National Reconnaissance Office. ICEYE-X36, by contrast, is a privately owned satellite, and Kosmos 2612 came much closer than in those earlier cases. Space law professor Aaron Brynildson told Axios that there is no strict legal limit on how close satellites can approach each other. However, countries generally avoid getting within six miles of another satellite.

Why do it? Samson lists a few options. Russia may want to learn the satellites’ capabilities and what they’re studying, or it may have interfered with sensors or communications. She leans toward a different reading: she thinks Russians are getting frustrated, in a stalemate for about six months, and this is a way to show military prowess in a way Ukraine can’t answer, since Ukraine matches Russia in drones but not in space.

RUSI’s June report is blunter about the options. It lists intimidation or interference through jamming, which uses radio noise to stop satellites from communicating. It adds that the range of options for protecting an ICEYE satellite is limited, and that defending satellites is a famous dilemma. LeoLabs says the event doesn’t establish hostile intent, but shows capabilities that could support intelligence collection, inspection, coercive signaling, interference or preparation for future counterspace operations.

ICEYE’s response was short: the company is aware, tracking closely, and says its constellation architecture is designed for continuity and resilience. CNN says it asked Russia’s defense ministry and Roscosmos for comment. The US Space Force had already described Russian satellites positioned near a Western commercial radar satellite used by Ukraine for imagery intelligence, according to Axios.

Private companies and independent observers, rather than the US Space Force, revealed the satellite encounter, highlighting the need for greater government transparency as space becomes more contested.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, satellite)

Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials.

Psychedelic Stealer is being distributed through compromised Ukrainian business websites. Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen to visitors. The affected sites included a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller, a psychological facility, a tool retailer, and an automotive retailer.

These were legitimate businesses with established social media profiles and third-party listings. Visitors were therefore directed to a trusted website they may have visited before, making the fake Cloudflare CAPTCHA harder to recognize.

That’s the core of what makes this campaign uncomfortable to dismiss. Visitors didn’t stumble onto an obvious fake domain. They landed on a site they may have visited before, for a business they already had some reason to trust, and got served a fake CAPTCHA instead of the page they were looking for.

The fake verification page imitates Cloudflare, complete with a randomly generated “Ray ID” in the footer and a fixed “visitor identifier” in the agreement text. Both look like the kind of tracking and authentication markers Cloudflare actually uses, and neither one means anything here.

“The page footer displays a randomly generated hexadecimal “Ray ID.” Cloudflare assigns a legitimate Ray ID to each request that passes through its network, but the value displayed by this lure is not evidence that Cloudflare performed the verification.” reads the report published by ArticWolf. “The agreement text also contains a fixed “visitor identifier.” Both identifiers imitate familiar verification and tracking elements, making the page appear more legitimate without providing evidence of an authentic Cloudflare verification. Put simply, all of this is fake; window dressing to fool the site visitor.”

The page is written in Ukrainian, which fits the target audience, but its HTML carries Russian-language comments and the document declares lang=”ru,” a detail that tells you something about who built it even if it doesn’t confirm nationality or location.

When the victim clicks the fake CAPTCHA, the page silently copies a Windows Installer command to the clipboard. It then tells the user to press Windows+R, paste the command and press Enter. There is no PowerShell involved, which can help the attack bypass security controls focused on detecting malicious PowerShell activity. Instead, the command directly launches msiexec.exe. It also includes the fake Cloudflare verification text, making the command in the Run window look like part of the verification process.

The downloaded MSI file then installs a 64-bit executable called psychedeliclove.exe, which Arctic Wolf Labs tracks as Psychedelic Stealer. The malware targets saved passwords from browsers such as Chrome, Edge, Brave, Opera, Opera GX, Vivaldi and Yandex. It also steals browser account tokens and targets cryptocurrency wallets, including Exodus, Atomic Wallet, Electrum, Bitcoin Core and Litecoin Core.

Beyond the one-time credential grab, the implant installs browser components and sets up a native messaging bridge that lets deployed browser content communicate with a local process on the machine. It creates a scheduled task for persistence named psychedelicloveUtils, profiles the host in detail including antivirus status and installed browsers, and then starts polling its command-and-control server for additional tasks. As Arctic Wolf Labs puts it:

“The implant tracks task state in executed_tasks.json, downloads attachments into downloads\<taskid>_<filename>, and supports EXE, COM, BAT, CMD, MSI, and PowerShell files.” states the report. “This gives operators a route to introduce additional code after installation.”

Which means whoever’s behind this isn’t necessarily done with a compromised machine after the initial credential sweep. The remote tasking capability supports EXE, COM, BAT, CMD, MSI, and PowerShell payloads, so the initial infection is better understood as a foothold than a finished operation.

The campaign also uses a management panel called “РУБЛЁВКА TDS” (Rublevka TDS), a name referring to the wealthy Rublevka area near Moscow. The panel allows the attackers to control the Windows Installer command delivered by each compromised website. This means they can change the payload URL from one place without modifying every infected page.

The panel also tracks how visitors interact with the fake CAPTCHA. It records when the page is opened, when the CAPTCHA is clicked and when the user presses the Done button.

The Done button remains disabled for about 35 seconds after the command is copied. The delay has no technical purpose. It simply gives victims enough time to follow the instructions and run the command, adding another layer of social engineering to the attack.

At collection time the panel showed 557 views, 426 clicks, and 79 complete events across 32 countries. Ukraine accounted for 446 of those views and 351 of the clicks, which combined with Ukrainian-language instructions and Ukrainian business websites makes the targeting intent about as clear as it gets. The panel labeled its complete events as “executions” and calculated a conversion rate from them, which Arctic Wolf correctly points out overstates actual confirmed compromises, since a complete event only means someone clicked Done in the browser, not that they ran anything.

The domain at the center of this, uasputnik[.]com, was registered September 9, 2026, updated three and a half hours later, and associated with lure URLs appearing on September 12 and 13. The whole operational window from registration to observed delivery fits inside a week.

For defenders, there are several useful indicators to monitor. Network traffic to uasputnik[.]com, followed by a request to admin777111777.php, could indicate an early stage of the attack. A later-stage sign is traffic to 193.178.159[.]128:8080, particularly requests to /api/v1/agent/ and /api/v1/ext/ with an X-API-Key header.

These indicators should be investigated together with file creation and process execution events to confirm whether a system has been compromised.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)