Fake nuclear alerts, on both sides of the war

Kia ora, this is It’s probably nothing for 3 November.

The overnight lead is grim and oddly symmetrical. Within hours, Ukraine’s Air Alert app and Russia’s EMERCOM app were each compromised, pushing fake radiation, chemical, missile and nuclear warnings to phones while both governments insisted the real warning systems stayed up. Attribution is still foggy, and that fog is part of the story.

Late on 1 November, Air Alert sent false warnings about radiation hazards, chemical threats, street fighting in Kyiv and an Oreshnik missile strike. Around 21:00 UTC the Ukrainian Air Force said on Telegram the app had likely been compromised and stressed there was no radiation threat. One Russian-language fake message referencing Oreshnik linked to a Telegram channel tied to a previously unknown group calling itself Hitcore Corp, which claimed responsibility, though that is only a reported claim. Ajax Systems said unauthorised people interfered with the app, push notifications were disabled and restoration began by early Monday, with the threat map still temporarily off; Air Alert had 6.6 million active users as of January 2026.

Hours later, Russia’s EMERCOM app pushed fake warnings of nuclear strikes across all regions, referencing the P1-Sun Ukrainian drone and urging food stockpiling. The emergencies ministry confirmed a massive cyberattack around 00:30 UTC on 2 November and said normal operation returned about 90 minutes later. A Kyiv-based group calling itself DC8044 claimed it got in through the app’s API and posted alleged technical details, again unverified. Both governments said sirens, SMS, TV and radio carried on, Ukraine’s national warning system operated normally, and Kyiv Digital stayed functional.

Even if the serious channels stayed up, this is a direct shot at public trust in the apps people actually stare at during raids. The timing is sharp too: the Ukrainian compromise surfaced around the same reported time a six-day Kherson ceasefire officially ended after Russia declined an extension. The Russian-language Oreshnik reference is the sort of sloppy tell that makes you raise an eyebrow, not a provenance certificate. A Ukrainian MP told the BBC it was almost certainly part of Russia’s cyber war, Russia has not explicitly blamed Ukraine, and the Hitcore Corp and DC8044 claims remain unverified. If you work anywhere near public-warning or crisis-comms tooling, this is worth a quiet tabletop: supporting apps are now clearly in play, even when sirens and SMS are fine.

On 2 November, airlines in our region began confirming Amadeus IT Group had told them about unauthorised access to one of its systems. Qantas said Amadeus advised the issue was contained in September, that there was no impact to Qantas’s own systems or databases, and that it had notified the Australian Cyber Security Centre. Cathay Pacific, Korean Air, Asiana, Japan Airlines and ANA were also named as affected, with hotels and car-hire companies globally reportedly caught up and hundreds of travel companies impacted. In a statement quoted by 7NEWS, Amadeus said it became aware of a vulnerability affecting a travel booking display environment, that certain booking-display data was accessible through it, that there is no evidence payment or financial data was accessed, and no indications it was exploited for ransomware. Cathay said containment included a password reset plus enhanced monitoring and detection.

The intrusion may be old news internally, but the disclosure is new and the blast radius is very travel-industry: a shared supplier, big airlines, and customer-impact questions still unresolved. No payment data is a useful qualification, not an all-clear; booking displays sit close enough to itineraries and identities that airlines are right to start counting carefully. Whether customer information was actually breached is still under investigation, and the scope of affected bookings and passengers is not established. If your organisation books a lot of travel through the big carriers, watch for airline-specific notices rather than waiting for one neat Amadeus FAQ.

Finally, FortiGuard Labs has attributed a South Asian espionage campaign to BITTER, also tracked as TA397, with high confidence based on lure filenames, command-and-control patterns, metadata and malware analysis. The report details PapRAT in C++ and Rust forms, aimed at government, energy and engineering targets in South Asia. The neatest chain is also the rudest: a malicious shortcut abuses the native FTP program’s exclamation-mark command execution, then uses curl, scripts and scheduled tasks without dropping a traditional malware executable. Two other chains deliver PapRAT through MSI installers triggered from a shortcut inside a virtual disk image or fetched via a WebDAV shortcut; in the third, PapRAT also pulls down WmRAT. The Rust variant grows the command set from eight to eleven, adds PowerShell execution, sleep and clean-exit commands, moves command-and-control from plaintext web traffic to encrypted web traffic, and hides the address with reversed, ROT-3-shifted strings. Fortinet published indicators and says customers have filtering and antivirus coverage.

It’s a useful reminder that living-off-the-land is not boutique anymore. An infection chain built from FTP, curl and scheduled tasks is designed to stroll past controls still waiting for a suspicious executable to clear its throat. If you’re hunting this, look for FTP exclamation-mark execution, curl or MSI activity kicked off by shortcuts, virtual-disk or WebDAV lure handling, and odd scheduled tasks around those events. Attribution is Fortinet’s high-confidence assessment rather than independent confirmation.

That’s the overnight read: trust is the target, travel is counting heads, and Windows’ own tools are still doing the shopping. I’ll keep an eye on what firms up.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.