Russia has carried out its deadliest attack against Ukraine this year, killing at least 17 people and injuring more than 100 in a wave of drone and missile strikes across the country.

Nine people died in the southern port city of Odesa and four were killed in Kyiv, including a 12-year-old boy. There were three fatalities in the Dnipropetrovsk region. Another person died in Zaporizhzhia oblast.

An air-raid alarm sounded in the capital at about 2.30am on Thursday. Explosions could be heard soon afterwards, as well as loud booms from Ukrainian air defences. According to Ukraine’s air force, Russia launched nearly 700 drones and dozens of ballistic and cruise missiles.

Mykhailo Barvinko, a 27-year-old PhD student, told the Guardian: “I heard the air-raid alarm and was about to go down to the bomb shelter when my windows blew in. There was a flash and two seconds later an enormous blast wave.”

Barvinko was unhurt but his third-floor apartment in Kyiv’s Podilskyi district was damaged. “It’s really surreal. We had nothing against them. One day Russia decides it has to kill and destroy us,” he said.

Another survivor, Olena, said she had dozed off after the first drone attacks, only to be woken by incoming missiles. “It was 6.53am. My clock fell over, the battery fell out and I happened to see the time. We were very scared and heard plaster falling. Our windows got damaged.”

The latest strikes came soon after Volodymyr Zelenskyy warned that Ukraine had practically run out of US-made Patriot air-defence missiles. Speaking last week, he said: “The situation is in such a deficit, it could not be any worse.”

Russia has repeatedly targeted civilian buildings and critical infrastructure from the beginning of Vladimir Putin’s 2022 full-scale invasion. Since Donald Trump returned to the White House last year, the attacks have worsened, leading to prolonged blackouts this winter in Kyiv and other cities.

Ukraine has pointed out that hundreds of Patriots were used up in the first days of the Iran war, as Tehran bombed its Arab Gulf neighbours with home-produced Shahed drones. There are now fewer advanced US missiles available for use by Kyiv.

Zelenskyy travelled on Tuesday and Wednesday to Germany, Norway and Italy in an effort to boost his country’s air defences. Ukraine has developed innovative drone-hunting drones, capable of knocking out Shaheds, and has signed long-term military production agreements with several Gulf states.

Kyiv is also developing a cheaper alternative to Patriots, but for now is unable to match the US system, which can intercept ballistic missiles. “Another night has proven that Russia does not deserve any easing of global policy or lifting of sanctions,” Zelenskyy wrote on X.

Accepting an award on Thursday in the Netherlands, he described Putin as a global threat. He urged the international community to continue its economic and military support for Ukraine, and held a moment of silence for the latest victims of Russia’s attacks.

Zelenskyy told the ceremony that Ukrainians did not enjoy the “fundamental freedom” to live without fear. “Freedom from ruins, freedom from those who bring ruins, freedom from those who seek to destroy everything that matters to normal people,” he said.

As dawn broke on Thursday, thick black smoke billowed above Kyiv. Those injured overnight in the city included three police officers and four medical workers who had gone to the scene of the first strikes and were caught in a second, “double tap”, bombardment.

Rescuers swept up glass and put police tape around a 3-metre-long enemy missile lying in a courtyard. The attack was the largest in weeks. In March, Russia fired 948 drones and 34 missiles in the space of 24 hours, in the biggest assault of the war on civilian areas.

Ukraine’s foreign minister, Andrii Sybiha, wrote on social media: “Such attacks cannot be normalised. These are war crimes that must be stopped and their perpetrators held to account.”

Meanwhile in Russia, the regional governor of Krasnodar, Veniamin Kondratyev, claimed that a 14-year-old girl and a woman were killed in Ukrainian strikes in the Black Sea port of Tuapse. He said the attacks had damaged apartment buildings and houses.

Ukraine’s military confirmed it had hit infrastructure in Tuapse as part of its campaign against Russian oil facilities used to finance the Kremlin’s war. It said it had also struck two oil depots in Russian-occupied Crimea.

Tuapse is one of Russia’s main southern ports, serving as an oil product export hub and handling dry bulk cargo, such as coal and fertiliser. It is also home to an oil refinery of the same name owned by Rosneft, Russia’s biggest oil producer.