Attack on Yandex. Have the attacks on Russian data centers affected Russian bots?

Between October 8 and 11, Ukraine attacked three Yandex data centers in Sasovo, Vladimir, and Kaluga. Earlier, in September, Russia had attacked Ukrainian data centers, including those belonging to Utels, Datagroup, and Faust.

Following the attacks, people began posting on social media that the number of Russian bots had decreased. For instance, Czech Member of the European Parliament Tomáš Zdechovský shared charts showing a sharp drop in bot traffic originating from Yandex networks.

Cloudflare generates such charts—a significant portion of global internet traffic passes through the company's servers, and its algorithms distinguish between actions taken by real humans and those performed by automated programs. According to Cloudflare, automated traffic from Yandex networks has fallen to near zero. However, this does not consist solely of bots; it also includes search engines and other legitimate services provided by the company.

Has the number of Russian bots truly decreased, and if so, for how long? We explore this in our "UP. In Brief" format.

How Russia uses bots

For Russia, bot farms are an integral component of the large-scale cognitive warfare that the Russian Federation is waging—not only against Ukraine but also against nations that Russia deems hostile. "This system operates in tandem with other disinformation tools: purchased or purpose-built Telegram channels (referred to as 'scum'), propaganda outlets like Russia Today and Sputnik Media, paid activists, 'useful idiots,' and hired spokespersons ('talking heads')," says Oleksandr Hlushchenko, a digital technology specialist at UP.

To launch bot farms on a mass scale, the Russians require a large number of accounts with an established history—accounts trusted by both social media platforms and users. This eliminates the need to waste time creating profiles from scratch.

About three to four years ago, Russian intelligence services actively employed a method of hijacking existing, legitimate profiles via phishing links embedded in comments on Facebook and Instagram.

Hlushchenko explains that social media platforms continuously collect detailed data about a user's device to detect suspicious activity.

"Algorithms analyze screen resolution, processor specifications, the amount of RAM and disk storage, installed fonts, language settings, the operating system, geolocation, and IP addresses.

To circumvent these safeguards, bot farms use specialized software suites to generate unique 'digital fingerprints,' effectively mimicking the behavior of real people across various devices. Bot farm operators go to great lengths to bypass social media platform rules—often understanding the security algorithms even better than the developers who created them," the expert explains.

Yandex’s infrastructure played a key role in hosting the control mechanisms for these bot farms.

Oleksandr Hlushchenko emphasizes that recent statistics from Cloudflare Radar—which recorded a 99 percent drop in activity from Yandex and its Yandex Cloud autonomous systems—require careful interpretation.

"This decline reflects the shutdown of the corporation's entire infrastructure, which encompasses a vast array of services, search engines, and tracking systems, such as Yandex Metrica," the expert explains.

At the same time, according to Hlushchenko, the control nodes for the bot farms were located within these data centers. The attacks either physically damaged the equipment or cut off its power supply; consequently, the bot farms lost contact with the accounts they managed, and the bot network ceased to function.

How the attacks affected the bots

"We must be realistic: there is currently no significant overall reduction in the activity of Russian bot networks, though their coordination has become considerably more difficult," stated Anait Hoperiya, Acting Head of the Center for Countering Disinformation, in the Ukrainian press.

Yuliia Dukach, Strategic Development Manager at the Molfar Intelligence Institute, explains that the Cloudflare chart—which sparked discussions about the disappearance of bots—primarily tracks bots that index websites. It provides no information regarding bots used for posting comments on social media. "So far, we are talking about the subjective perceptions of social media users, but unfortunately, we do not see any quantitative evidence for this," says Dukač.

According to her, the bot farms she monitors on Telegram have not reduced their activity.

Hoperia states that the most significant drop in bot activity was recorded in France and the United States, where the reach of those promoting Russian propaganda has fallen sharply.

"Temporary technical disruptions were observed in the operation of automated information networks such as Pravda, InfoDefense, and Nod of Time—channels through which the Russian Federation actively promotes propaganda abroad," Hoperia emphasizes.

The number of posts was cut in half as a result of the strikes. Within 12 hours, the volume of posts began to recover—either through manual intervention or by utilizing backup capacity.

For Ukraine, the reduction in bot activity was first noticeable on the social network X. However, a detailed analysis by the Central Intelligence Agency indicates that the overall intensity of anti-Ukrainian propaganda remains high, as the adversary maintains redundant communication channels.

"For instance, we are currently verifying reports regarding the complete or partial shutdown of local occupation-related resources in the Donbas. From a technical standpoint, this is quite plausible, provided their administrative systems or hosting infrastructure were integrated into the affected Yandex data centers," adds Anait Hoperia.

According to the expert, the attacks on Yandex data centers have revealed a key point: Russia is utilizing civilian IT infrastructure as a weapon in cyber warfare. They also confirmed that it is Moscow that stands behind anti-Ukrainian information attacks in Europe and the United States.

***

Hoperia emphasizes that attacks on data centers in Russia could become an effective component of a comprehensive strategy to counter Russian propaganda.

"Physical damage to digital infrastructure destroys automation—Russia is forced to switch to manual operations, which slows down attacks and compels the Russians to expend vast resources, time, and money on restoration, relocating servers, and establishing new logistics chains under sanctions. It also demonstrates that the aggressor's digital infrastructure is no longer secure. Physically impacting the enemy's digital capabilities significantly diminishes the effectiveness of their information operations," she concludes.

Dukach also believes such strikes are effective: when Russia loses its own servers and language models, its information operations become more costly.

Furthermore, strikes on the aggressor's data centers have had another side effect: millions of ordinary Russians—facing disruptions to taxi services, deliveries, and Yandex navigation tools—have suddenly realized that the war can affect their daily comfort, even deep within the rear.