Russian bot activity plummeted 84% after Ukraine attacked Yandex data centers, but bots were back up and running at full strength within two days.
- Ukraine’s CCD says suspicious Russian bot posts in its sample fell 83.6% on October 8 after a strike shut down Yandex’s Sasovo data center.
- The same data shows that volume was back above pre-strike levels on October 10, with a smaller drop of 42.6% after Vladimir closed.
- Cloudflare and Graphika did not find a comparable drop in Western political communities, although Russian-language Telegram output fell between 5% and 15%.
Ukraine’s Center for Countering Disinformation (CCD) says suspected Russian bot accounts went almost silent after drones destroyed Yandex data centers earlier this month, and the volume of messages over a monitored network fell by 83.6% in a single day.
The findings come from a CCD analytical report dated October 15, 2026. Using Osavul monitoring software, analysts tracked 22,664 messages from 5,201 accounts showing signs of inauthentic behavior across 26 topics in Ukraine’s Facebook and Telegram space between October 6 and 12.
The 83.6% figure is real, but the same report shows that those accounts are posting more in 48 hours than before, and independent data from Cloudflare shows that at least some of the malicious automation running in the Yandex cloud didn’t die but moved house.
Latest videos ofTechnologyRadar
A collapse in automated traffic after Yandex Cloud took a beating
The first collapse occurred on October 8, hours after a drone strike and fire shut down Yandex’s Sasovo data center in the Ryazan region, home to two of the company’s three supercomputers.
Daily messages fell from 4,032 to 660, and active accounts fell from 1,526 to 258. Telegram was the hardest hit, with a 90% drop, while Facebook fell 79.5%. A second, more shallow drop followed the October 11 strike, which Yandex said had brought its Vladimir site to a complete halt, with messages falling 42.6% on October 12, from 4,711 to 2,704. A subset of 98 accounts that the CCD flagged for justifying the invasion or inciting hatred followed the same curve, down 77.8% on October 8 and down 49.2% on October 12.
The most telling detail is in the middle. The October 9 strike at Yandex’s Kaluga campus, which the company describes as its largest, only partially took the site out of service, and the CCD did not record any drop in activity that day. The two drops align with the two complete shutdowns, as would be expected if these accounts were dependent on that infrastructure, although that is not proof in and of itself.
Surprisingly fast response time?
What the 84% figure touted by the CCD omits is how briefly the silence lasted. Message volume recovered to 2,231 on October 9, then reached 4,585 on October 10 and 4,711 on October 11, both above the pre-strike level. The report’s tracking window closes on October 12, so it cannot show whether the second drop recovered in the same way.
The agency has also been downplaying the event in other forums; Two days before the report, the CCD said that posts in some groups on the Pravda, InfoDefense and Nod of Time networks were roughly halved for about 12 hours, and emphasized that it had not recorded a significant overall decline in Russian bot farms.
On October 16, the summary of statements by CCD’s head of media literacy Ivan Slychko described the effect as “a disruption of automation, not the complete disappearance of bots.”
It also does not mention a similar comparison for ordinary accounts. On the afternoon of October 8, banks, retailers, mobile operators and news sites across Russia suffered outages. Without such information, it is difficult to separate bot farms that lose their servers from operators within Russia that simply lose connectivity.
The CCD is not an impartial actor here; It is a body attached to the National Security and Defense Council of Ukraine, and has an incentive to exaggerate victories even when the data does not always support them.
President Volodymyr Zelenskyy had already gone ahead and said at the Warsaw Security Forum that after the attacks “it suddenly became a little easier to breathe on many social media platforms” and that this could have been a deciding factor in how the CCD constructed its narrative.
Beyond Ukraine, the “bots went silent” story was largely based on a Cloudflare Radar chart showing that automated traffic from Yandex’s AS13238 network fell to well below 1% of its recent peak on October 11. As we noted at the time, that traffic was much more likely to be crawlers than fake social media accounts, and “bot” is a vague word when automated requests make up about half of all web traffic.
Cloudflare’s own autopsy confirms this. Marina Elmore and Lai Yi Ohlsen found that 99.5% of AS13238 requests were automated, mostly verified Yandex search crawlers, and that the network supplied only about 7% of requests to bots of Russian origin. Bot traffic from Russian IP addresses reaching a social platform’s post, reply, and similar endpoints fell by just 5.7% during the event period.
Graphika reached a similar verdict from the other side. Founder John Kelly’s analysis of the AfD, MAGA and Reform UK communities that viral posts reported had gone silent found that none lost their active accounts or their heaviest posters.
AfD-linked accounts posted 40,365 times on October 11, down 4% from the previous week and well within normal swings, while MAGA mentions on X increased 25% in the eight hours after the Vladimir strike. Georgetown’s Renée DiResta, writing in Lawfare, was blunt about the viral version: “It’s a great story. But it seems more fiction than fact.”
For now, the most defensible reading of the CCD figures is narrower than its headline. Taking down the right data center may briefly reduce production of Russia-based accounts targeting Ukraine. Keeping them silent would mean attacking the servers they’ll move to next, and based on evidence so far, that move takes a day or two.
As one analysis of battlefield computing puts it particularly well, resilience comes from designing for disconnection, and bot operators seem to have learned that lesson faster than Yandex.
Through UNITED24 media
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment