Hackers Hijack the Kyiv Independent’s Newsletter to Send a Fake Nuclear Strike Warning

Four Fake Emails, Starting at 1 a.m.

According to the Kyiv Independent, the attackers sent four emails, in Russian and English:

• 1 a.m. Kyiv time on November 4 (23:00 UTC on November 3), in Russian. It claimed that Volodymyr Zelensky had “launched a nuclear warhead at Kyiv” after meeting Vladimir Putin, told recipients to take shelter and gave the username of an anonymous Telegram channel. The newsroom says that channel posts mocking messages and threats in Russian about attacking Ukrainians.
• 2:30 p.m., a second Russian-language email.
• 3:05 p.m., a similar email in English, then one more in Russian.

The later emails made up claims about a physical attack on Zelensky, The Record reports. The attackers also posted similar messages on the website, and staff deleted them.

The first email became public when journalist Ostap Yarysh posted a screenshot of it (dev.ua). By 11:22 a.m. Kyiv time, dev.ua was already reporting that editor-in-chief Olga Rudenko had told readers the newsroom hadn’t sent it. Three more fake emails still went out from 2:30 p.m. onward.

What the Kyiv Independent Says

Rudenko says one of the outlet’s systems was hacked and that “everything we know at the moment, including the contents of this email, points to a Russian operation” (IMI, quoting her letter to readers). No group has claimed the attack, and the outlet hasn’t published technical evidence. The attribution rests on what the messages say.

“This is the first time an attack like this has happened to us, and we are treating it very seriously,” Rudenko said. “Attacks like these are part of the war we cover every day — an attempt to sow confusion and erode trust.”

Chief operating officer Zakhar Protsiuk said the team had been working on stopping the attack “since the night together with cybersecurity specialists.”

On payments, the outlet says members’ and donors’ bank details are not at risk, because a third-party payment provider handles all payment and banking information.

Still unknown:

• how the attackers got into the CMS and the newsletter service;
• which newsletter service it was;
• whether they could see or copy the subscriber list;
• how many people received the emails.

Same Method as the Air Alert Hack

Rudenko linked the two attacks herself. On the night of November 1, the Air Alert app, which Ukrainians use for air raid warnings, sent Kyiv users false alerts in its familiar emergency voice. One Russian-language message warned of a strike with Russia’s Oreshnik missile and linked to the Telegram channel of Hitcore Corp, a previously unknown group that claimed the breach (The Record). According to the Kyiv Independent, Zelensky called it a Russian attack in an interview with PBS News on November 2.

There is news on that hack too. The app’s volunteer developers, Ajax Systems and Stfalcon, now say that “unauthorized access was gained to the operator’s interface, not the mobile application.” They say the app “does not store or transmit personal data,” that the operator interface and the app’s main functions were back within two hours, and that a security audit is still running (dev.ua, citing the team’s statement).

The Record notes that no connection between the two incidents has been confirmed. The method is what they have in common. By the operators’ own accounts, nobody faked a sender in either case. The attackers got into the tool the real sender uses, so the warning arrived looking exactly like the real thing: the app’s own alert voice in one case, a newsroom’s own newsletter in the other.

The same night as the Air Alert hack, Russia’s Emergencies Ministry app was hijacked to send false warnings of nuclear warheads launched at Russia. DC8044, a group that describes itself as a Kyiv-based hacking community, claimed that one.

If You Got One of These Emails

• The sender address won’t tell you anything here. The emails came through the Kyiv Independent’s real newsletter. Judge an alarming claim by whether official channels confirm it (in Ukraine, the Air Force, regional administrations and the sirens), not by who it seems to come from.
• Don’t open or join the Telegram channel named in the email. The newsroom says it posts threats.
• Your card details are not at risk, according to the outlet, so there’s no need to cancel your card over this.
• Be careful with follow-up emails “from the Kyiv Independent” that ask you to log in, confirm your subscription or pay. The outlet hasn’t said whether the attackers could see its subscriber list.

If you run a newsletter yourself, the account that can send to your whole list is a broadcast channel, and it needs the protection that goes with that. Give everyone with send rights phishing-resistant sign-in (security keys or passkeys), keep that group small, review the API keys and integrations that can send on your behalf, and turn on send notifications if your platform has them.