Subscriptions
Read our Monthly Magazine
And support our mission to provide fearless stories about and outside the media system
When Ukrainian drones struck Yandex’s data centres in Russia recently, social media users were quick to declare victory over Russian bot farms, touting claims about reduced internet traffic as proof that Russian bots on platforms like X had been wiped out in the strikes. Those claims largely missed the real story, though, which is both more complicated and much more revealing than the narrative about bot farms.
On October 8, Ukrainian drones struck Yandex’s data centre in Sasovo, in Russia’s Ryazan region. Yandex told Reuters that the attack started a fire and forced the facility to suspend operations. The next day, another strike caused damage to a Kaluga data center, and on October 11, Yandex’s facility in Vladimir was forced to shut down completely after it was hit. In four days, three pieces of the country’s digital backbone were hit.
According to the BBC, the strikes were meant to hit “places that provide revenue streams for Moscow’s war machine.” The data suggests they had a major impact. Cloudflare reported that Yandex Search requests fell as much as 99% below baseline, and requests from Yandex.Cloud were 90 percent below baseline. Reuters also reported problems at Cian, Litmarket, Russian Railways, and Spartak Moscow’s website, and the operator of a Russian dating app reported that he lost access to his app and the backup database needed to restore it elsewhere.
Don’t miss a story
The Real Story About Russian Bots
Not long after, social media lit up with posts claiming that the drone strikes had wiped out “Russian bot” activity and cleaned up social media platforms like X. Some users claimed that bot accounts had disappeared from X, and that online discourse was “much better” since the Russian bot networks were taken down.
The narrative quickly went viral and spread beyond social media users. U24, a Ukrainian government-run platform launched in 2022 “to raise money and influence international opinion for Ukraine in the Russo-Ukrainian war,” produced a report claiming that “Russian bots went silent” on social media following the strikes. Even Ukrainian President Volodymyr Zelenskyy joined in, saying that “everyone noticed” a sudden drop in bot activity on social media due to the strikes. A member of the European Parliament also pointed to what he claimed was a drop in support for the far-right AfD coinciding with the drone strikes.
But the real story is not quite that neat and clean.
Cloudflare’s analysis measured web requests reaching websites protected by its network. The numbers it reported describe requests from Yandex networks—not people, social media posts, or propaganda accounts. Most of the “bot” activity measured was due to verified search crawlers, which are different than the social bots that most people are familiar with. In practical terms, the biggest impact of the drop in bot activity reported by Cloudflare was a loss of Yandex’s ability to refresh its search index, not a disappearance of online propaganda or social media bots.
On Yandex.Cloud, affected services included applications and automated traffic. In one particularly interesting case, a high-volume pattern of automated activity disappeared from Yandex.Cloud and reappeared on other Russian hosting networks with the same technical fingerprint. The requests targeted a gambling site. This case provides direct evidence that some software shifted providers when the outages hit, showing how malicious activity can bounce back and continue even after a physical attack on the infrastructure it depends on.
A Short History of Trump’s Long-Held Connections to Russia
The President’s deep ties to Russian interests require far greater scrutiny given his ongoing betrayal of Ukraine, argues Zarina Zabrisky
A Peek Inside Russia’s Information Warfare Arsenal
There is scant evidence that social media was significantly affected. In an analysis published on October 14th, Cloudflare reported that it found little change in Russian-origin or global social media traffic. “Based on our assessment, the data does not appear to support the claims that the strikes crippled social media manipulation,” Cloudflare wrote in its report.
Thus far, the only evidence that exists of a drop in social media activity comes from the Ukrainian government’s Center for Countering Disinformation (CCD), which says posts on Telegram and Facebook from a network of just over 5,200 pro-Russia accounts it monitors fell from 4,032 to 660 on October 8, the day the Sasovo data center was hit. That number rebounded above its pre-strike level within three days and then fell again after another Yandex data center was reported shut down on October 12.
That pattern of activity — a drop, followed by a rebound, and then another drop several days later, coinciding with the timing of the drone strikes — is potentially very revealing. If the accounts being monitored by CCD are, indeed, part of a Russian influence operation, this pattern suggests that Russia’s influence capabilities were developed to be portable and resistant to physical attacks on their computing infrastructure, and that they were able to be transferred to a different network when the first went down. This would be in line with what Cloudflare observed when it saw malicious activity moving to a new hosting network after disappearing from Yandex.Cloud.
While the story about bots being obliterated by Ukrainian drone strikes is tempting to believe, it doesn’t reflect the reality of what happened — or the reality of Russia’s information warfare tactics. Russian malign influence operations have expanded beyond the fake-account and troll-farm model that dominated news coverage in 2016. While bots are still an important part of Russia’s information warfare arsenal, there is now a bigger emphasis on influencer networks and media distribution. Most Russian influence networks operate across multiple platforms and maintain their own websites, which can be replaced when disrupted.
Rather than looking only at bot activity, a more useful question is how an influence campaign moves a message from initial production to a receptive audience — and which parts of that pipeline are exposed, replaceable, or difficult to observe. Our objective should be to understand the operation well enough to interrupt deceptive coordination and measure what changes afterward, rather than treating the disappearance of bots as proof that influence has stopped. It hasn’t, and believing otherwise would leave us even more vulnerable to its effects.