Hackers send fake nuclear and chemical alerts through Ukraine's air raid app, and Russia says its own warning app was hit hours later

The stories

8 stories on this beat today.

Every story told the same way: what happened, who is involved, why it matters, how it works, the truth and the good news.

1. 01

   Hackers send fake nuclear and chemical alerts through Ukraine's air raid app, and Russia says its own warning app was hit hours later

   4

   fake alerts on Ukraine's Air Alert app in about two minutes

   radiation, nuclear, chemical and street fighting, from 22:47 local time [1]

   22:47 to 23:53

   from the first fake alert to the all-clear messages

   the all-clear came alert by alert, for each false Kyiv warning [1]

   6 days

   of local ceasefire in Kherson, ending as the alerts went out

   it let hundreds leave the occupied town of Oleshky [2]

   What happened

   • Late on Sunday, Ukraine's Air Alert app told users: "Radiation threat declared in Kyiv." [1]
   • By 22:49 it had also warned of a chemical attack and of street fighting in Kyiv. [1]
   • "There is no radiation threat! Stay calm," Ukraine's Air Force then posted on Telegram. [1]
   • Hours later, Russia said its own warning app had suffered "a massive cyberattack". [1]
   • 4 fake alerts arrived in about two minutes, starting at 22:47 local time. [1]
   • One, in Russian, promised a nuclear alert across Ukraine and said "it's Oreshnik flying". [1]
   • At 23:53 the app sent an all-clear for each false Kyiv alert, one by one. [1]
   • Because of the app, loudspeakers in Ukraine's Lviv region played a radiation alarm too. [1]
   • Several regional leaders said on Telegram the app was apparently hacked, with no local threat. [1]
   • Natalya Zabolotna, who heads the Vinnytsia region, warned people not to click a link. [1]
   • She said the link could be phishing: a trap to steal people's details. [1]
   • Ukraine's ministry first said the app was off for maintenance after it had "apparently been compromised". [1]
   • A separate app only for Kyiv kept working normally, the city's authorities said. [4]
   • SPRAVDI, Ukraine's Centre for Strategic Communications, blamed Russia for the hack on X. [4]
   • It asked people to "disregard" any "strange messages" in the app. [2]
   • Asked if the app was hacked, Air Force spokesman Yuriy Ignat said: "Yes, it has been." [7]
   • Russia's Emergencies Ministry said the attack let hackers send "false information to the public". [5]
   • Russia's ministry did not say who was behind it. [4]
   • Atesh, a Ukrainian partisan group in Russian-held areas, said on Telegram the app was hacked. [1]
   • UNN, a Ukrainian news site, reported fake alerts of a nuclear threat inside Russia. [1]

   Who is involved

   Oreshnik is a Russian hypersonic missile, meaning a very fast one. [3]

   Air Alert is supported by Ukraine's Ministry of Digital Transformation. [1]

   Ukrainians use it to hear, in real time, about incoming Russian air attacks. [4]

   Its app warns people of incoming drone attacks and other threats. [3]

   • Regional leaders said there was no threat
   • Air Alert warns of Russian air attacks
   • SPRAVDI Ukraine's Centre for Strategic Communications; it blamed Russia
   • Russia blamed for the hack
   • Atesh a Ukrainian partisan group in Russian-held areas; it said Russia's app was hacked
   • UNN Ukrainian news site
   • Ukraine's Air Force Ukraine's military air arm; it said the alerts were false and the app was hacked
   • Ukraine's Ministry of Digital Transformation the ministry that supports the Air Alert app; it took the app offline
   • Russia's Emergencies Ministry the Russian government ministry for emergencies, which runs a warning app; it says the app suffered a massive cyberattack

   How it unfolded

   The alerts came minutes before a local ceasefire in Ukraine's Kherson region ended at 23:00. [1]

   The truce lasted 6 days, the longest of the war, and let hundreds leave occupied Oleshky. [2]

   In December 2023, a hack on Kyivstar, Ukraine's biggest telecoms company, disrupted air raid sirens. [8]

   That attack left Kyivstar's customers without mobile signal or internet for 2 days. [8]

   1. 22:47 radiation threat
   2. 22:49 chemical threat
   3. 22:49 street fighting
   4. Sunday night Ukraine's app sends fake alerts
   5. Hours later Russia says its app was hit
   6. 22:47 first fake alert
   7. 23:53 all-clear messages
   8. 22:47 fake alerts begin
   9. 23:00 Kherson ceasefire ends
   10. Dec 2023 Kyivstar hacked, sirens disrupted
   11. Sunday Air Alert app hacked
   12. Tue 27 Oct a local ceasefire begins in the Kherson region [6]
   13. Sun 22:47 fake alerts start on Ukraine's Air Alert app [1]
   14. Sun 23:00 the Kherson ceasefire ends [1]
   15. Sun 23:53 the app sends all-clear messages [1]
   16. Mon Russia says its warning app was hit by a cyberattack [3]

   Why it matters

   People often have only minutes to reach shelter from a ballistic missile. [7]

   Kherson's governor told people to "respond immediately to warnings about Russian attacks" as the truce ended. [3]

   How it works

   Emergency managers, like Russia's Emergencies Ministry, send each warning by several channels at once. [2]

   Russia's ministry says it also warns people by sirens, loudspeakers, texts, TV and radio. [2]

   It called the app "only an additional, ancillary news service". [2]

   The truth

   • What is really going on Ukraine's and Russia's public warning apps were both used to send fake alerts within hours of each other on Sunday night, and neither government has said how the attackers got in.
   • Why it works on people A warning that gives people minutes to find shelter leaves no time to check it first, and that is what a fake one relies on. [7]
   • The BBC has not verified a screenshot of a fake Russian alert that Atesh posted. [1]
   • Neither government has said how the attackers got into its app. [1]
   • Who gains Whoever sent the fake Kyiv alerts — They reached phones across Ukraine through an app the state supports, and loudspeakers in the Lviv region repeated them. [1]
   • Who pays People in Kyiv and the Lviv region — They got, or heard aloud, false radiation and chemical warnings late at night. [1]
   • Nobody knows yet

     How the attackers got into Ukraine's Air Alert app, and whether they could do it again.

     Ukraine's digital ministry said only that the app had apparently been compromised, and took it offline for maintenance. [1]

   • Nobody knows yet

     Who broke into Russia's warning app.

     Russia's ministry did not say, and the BBC could not verify the screenshot that Atesh posted. [1][4]

   • Nobody knows yet

     How many people took cover, or clicked the link in the fake message.

     No official has published a figure; one regional head only warned people not to click. [1]

   Good news

   • A separate warning app for Kyiv kept working normally while the national one sent fake alerts. By 23:53 the same night, the national app had sent an all-clear for each false alert.

   What comes next

   Russia's ministry says specialists are working to restore its app. [2]

1. 02

   Binance users take out $3.64bn as it reopens

   What happened

   • On Sunday, Binance customers took out $3.64bn more than they put in. [9]
   • Between 06:00 and 15:30 GMT, it paid out $4.649bn and took in $1.01bn. [9]
   • That gap is just over 2% of the $171bn it holds for customers, Binance says. [9]
   • On Saturday, Binance said it had replaced 90% of the stolen coins. [10]
   • Late on Saturday it said 95%, with harder-to-buy coins still to come. [11]
   • It used its own treasury, a $1bn user fund and insurance money to buy them back. [10]

   Who is involved

   The FBI blames TraderTraitor, a North Korean hacking group, for the theft. [10]

   • TraderTraitor North Korean hacking group
   • Richard Teng Binance co-chief executive

   How it unfolded

   Binance, the world's biggest crypto exchange, had about $6.3bn stolen last week. [9]

   Why it matters

   Co-chief executive Richard Teng says users will not bear the cost of the hack. [10]

   The truth

   • So the cost lands on Binance's own reserves, not on the people whose coins were taken. [10]
   • Who gains Binance — It says withdrawals spiked and then settled, and Sunday's net outflow was just over 2% of the $171bn it holds. [9]
   • Who pays Binance — It is buying back the stolen coins from its own treasury, a $1bn user fund and insurance money. [10]
   • Nobody knows yet

     When Binance will replace the last 5% of the stolen coins.

     Binance says those coins are harder to buy in the amounts needed and may take longer. [11]

   Good news

   • Binance says it has replaced 95% of the coins stolen last week, and its customers began withdrawing again on Sunday.

   What comes next

   More services will reopen in stages once security checks are done, Binance says. [9]

1. 03

   Australian police scan 1.38 million faces

   What happened

   • Police in Western Australia scanned 1,380,882 faces in a five-month trial of live face recognition. [12]
   • Cameras on or near police vehicles matched faces against a list drawn from police databases. [12]
   • The trial, which ended on Saturday, led to 122 arrests, police say. [12]
   • It also gave 9 wrong alerts, which police put at an error rate of 0.00065%. [12]
   • "No one was arrested," WA police commissioner Col Blanch said of the wrong alerts. [12]
   • Police say images of people not on the list were blurred at once and deleted. [12]

   Who is involved

   • Civil Liberties Australia a rights group

   Why it matters

   The state's privacy watchdog warned of "collective privacy harms" when the trial was announced. [12]

   How it works

   A rate depends on what it is counted against: scans, or the 122 arrests. [12]

   Why a warning goes out on more than one channel

   Emergency managers send each warning down several separate channels, so a fake on one can be spotted because the others stay quiet.

   The twist

   The fake radiation alert reached a whole country through one app. The Air Force used its own channel to call it false, and Kyiv's separate app kept working normally.

   The picture

   Air Alert, nationwidefake alerts

   vsvs

   Kyiv's own appnormal

   Step by step

   1. 1 A warning has to reach people within minutes
   2. 2 So it is sent down several separate channels at once
   3. 3 Any one channel can break or be taken over
   4. 4 A false message on one channel does not appear on the others
   5. 5 Officials use the channels still working to say it is false

   The same force, elsewhere today

   Where this chain is also running, in today's other stories.

   • Shelly Store UK's card theft

     The shop's own website showed nothing wrong, and Stripe, a separate company handling its payments, saw the problem and sent the warning.

   • Western Australia's face-scanning trial

     A camera alert was not an arrest on its own: an officer checked each one in person, and police say none of the 9 wrong alerts led to an arrest.

   • The LXD flaw

     Incus, a separate project built from the same code, reported the flaw, and Canonical then fixed its own copy.

   Where you've seen this

   Fire alarms in big buildings

   bells, flashing lights and a spoken message, so one failure does not leave people unaware

   Aircraft cockpits

   two pilots and separate instruments, so one wrong reading can be spotted against another

   Hospital medicines

   a second nurse checks a risky dose before it is given

   The catch

   Extra channels help only if they are really separate. In the Lviv region, loudspeakers fed by the app played the fake radiation alarm too.

   And the whole of it

   Everyone who got that alert on Sunday night was inside Ukraine's warning system, checking one channel against another late at night. The app's makers, the Air Force and each person holding a phone could each see only their own part of it.

   The truth

   • Civil Liberties Australia says if half the 122 are not convicted, the wrong rate is 50%. [12]
   • Experts say face matching has made more wrong matches for people with darker skin. [12]
   • Who gains Western Australia Police — Its face-scanning vans produced 122 arrests in five months, police say. [12]
   • Who pays People scanned in Western Australia — 1,380,882 faces were checked with no reasonable suspicion, Civil Liberties Australia says, and 9 people were wrongly flagged and questioned. [12]
   • Nobody knows yet

     How many of the 122 arrests in Western Australia end in a conviction.

     Civil Liberties Australia says the real error rate is known only once those cases reach court. [12]

   What comes next

   The vans are off the streets while police review the trial and its safeguards. [12]

1. 04

   US charges over fake "ghost students"

   What happened

   • US prosecutors say fraudsters used stolen identities to enrol fake "ghost students" in colleges. [13]
   • They say the aid was then moved to bank accounts controlled by people abroad. [13]
   • A Kenyan man was charged on 21 October; officials announced it on 29 October. [13]
   • Investigators flagged 830,840 possibly fake student aid IDs, tied to nearly $130m in September and October. [13]
   • That $130m is aid linked to suspect accounts, not confirmed losses. [13]
   • In one Virginia case, prosecutors say a Kenyan man received over 700 refunds, about $1.44m. [13]
   • Officials say the fraudsters used what they called "super intelligence" to do coursework. [13]

   Who is involved

   It calls its investigation Operation Ghostbusters. [13]

   How it unfolded

   1. 21 Oct a Kenyan man charged
   2. 29 Oct case announced

   Why it matters

   Student aid is public money, so prosecutors say the fraud takes from US taxpayers. [13]

   How it works

   Identity theft means using someone else's personal details to act as them, here to enrol. [13]

   The truth

   • People whose identities were stolen can find student loan debts in their own name. [13]
   • Who gains The alleged ghost-student fraudsters — Prosecutors say one Kenyan man received over 700 aid refunds worth about $1.44m. [13]
   • Who pays People whose identities were stolen for fake students — They can find student loan debts in their own name for courses they never took. [13]
   • Nobody knows yet

     How much of the $130m tied to suspect student aid accounts was really lost.

     US officials say the figure is aid linked to suspect accounts, not confirmed losses. [13]

   Good news

   • With Kenyan investigators, US officials seized over $750,000 in crypto, the first such seizure in Kenya. [13]
   • US and Kenyan investigators seized more than $750,000 in cryptocurrency linked to the US student aid fraud, the first such seizure in Kenya.
2. 05

   Top-rated flaw fixed in Canonical's LXD

   What happened

   • Canonical, a software company, fixed a flaw rated 10 out of 10 in its LXD software. [14]
   • The flaw let attackers log in as a trusted user or machine, without its secret key. [14]
   • Posing as a powerful account, an attacker could take full control of the machine, Canonical said. [14]
   • A standalone LXD server does not open this connection to the network by default. [14]
   • Canonical's fixed versions include LXD 6.10.1 and MicroCloud 3.4.1. [14]

   Who is involved

   LXD runs virtual machines, computers made of software; MicroCloud joins LXD machines into one cluster. [14]

   • LXD manages virtual machines
   • MicroCloud joins LXD machines into a cluster
   • Incus community project built from LXD's code

   How it unfolded

   Incus, a community project built from LXD's code, reported the flaw. [14]

   Why it matters

   MicroCloud clusters are most exposed: a machine's digital ID can be captured as it joins. [14]

   How it works

   The server checked every digital ID a visitor sent, though only the first is proven theirs. [14]

   Incus, a separate project built from the same code, reported the flaw, and Canonical then fixed its own copy.

   The idea, in story 03: Why a warning goes out on more than one channel →

   Good news

   • There is no public sign anyone has used the flaw in an attack. [14]
   • Canonical released fixed versions of LXD and MicroCloud, and there is no public sign that the flaw rated 10 out of 10 was ever used in an attack.
3. 06

   New spy malware hid among Windows updates

   What happened

   • Kaspersky, a Russian security firm, found new malware, harmful software, aimed at Asian government computers. [15]
   • It targets a special version of Windows 10 used only by government bodies there. [15]
   • Kaspersky calls it NetamLoader, and found it on one computer in the first half of 2026. [15]
   • It sat in a package in the folder Windows uses for its own update files. [15]
   • The package mixed it with real programs, some signed by Microsoft. [15]
   • Once running, it could interfere with security scans, hide itself and delete logs. [15]
   • It could also download more harmful code and talk to the attackers' servers. [16]

   Who is involved

   • Kaspersky Russian security firm

   Why it matters

   A country with its own Windows build must protect all of it alone, Kaspersky says. [15]

   How it works

   Kaspersky suspects a supply-chain attack: breaking into a trusted supplier to reach its customers. [15]

   The truth

   • Kaspersky did not name the country, and could not link the attack to a known group. [15]
   • Nobody knows yet

     Which government NetamLoader hit, and what it took.

     Kaspersky found one infected computer and could not confirm that any data was stolen. [15]

4. 07

   UK smart-home shop finds card-stealing software

   What happened

   • Shelly Store UK, which sells Shelly smart-home gear, says payment data may have been stolen. [17]
   • Its payment company, Stripe, warned it, and it found unauthorised software on its website. [17]
   • Card details, names, billing addresses and contact details may have been taken, it says. [17]
   • The shop says it cannot tell whether customers' data was accessed or copied. [17]
   • One customer told The Register of a GBP 221.28 charge made in Australia on 26 October. [17]
   • The shop removed the software, tightened security and told the ICO, the UK data watchdog. [17]

   Who is involved

   It is independent of Shelly, the company that makes the devices. [17]

   • Stripe payment company; sent the warning
   • Shelly Store UK found the software after

   Why it matters

   It is contacting customers from the affected period and told them to check card statements. [17]

   How it works

   The shop's own website showed nothing wrong, and Stripe, a separate company handling its payments, saw the problem and sent the warning.

   The idea, in story 03: Why a warning goes out on more than one channel →

   The truth

   • What is really going on On the same day, a card theft at Shelly Store UK was spotted by its payment company, Stripe, not by the shop. [1][17]
   • The warning came from Stripe, the payment company, rather than from the shop's own checks. [17]
   • Who pays Shelly Store UK customers — Their card details may have been taken, and one says a GBP 221.28 charge appeared in Australia. [17]
   • Nobody knows yet

     Whether any Shelly Store UK customer data was actually copied.

     The shop's investigation is still going, and it has not said when the software was put on its site. [17]

5. 08

   'Secure' USB drives fail their tests

   What happened

   • A researcher found that Lenovo's fingerprint USB stick, sold as encrypted, held a plain memory card. [18]
   • The researcher, Xusheng Li, found the fingerprint reader only switched the USB connection on. [18]
   • So anyone holding the stick could read its files, Tom's Hardware reports. [18]
   • A follow-up last week, using an AI tool, tested drives and software from other makers. [18]
   • It found two hidden "backdoor" accounts with simple passwords in SecZure's YutianDun. [18]
   • Netac's protection tool was broken in about seven minutes, because a fixed key was built in. [18]

   Who is involved

   Encrypted means scrambled so that only someone with the right key can read it. [18]

   • Xusheng Li security researcher

   How it unfolded

   Lenovo put out a fix early this year, which means calling a service line in China. [18]

   Why it matters

   People who bought these drives to protect files hold devices that may not protect them. [18]

   How it works

   Security engineers call checks done by the buyer's own software client-side, and they can be skipped. [18]

   Li puts it plainly: "client-side validation is never secure". [18]

   The truth

   • Li did not warn KakaSoft, Nexcopy or SecZure first, saying sold drives cannot be recalled. [18]