Yandex Strikes and Russian Bot Farms

At a glance: Ukrainian drone strikes between Oct. 7 and Oct. 11, 2026 hit three data centers run by Yandex, the Russian tech company often called “Russia’s Google,” in Sasovo (Ryazan region), Kaluga region and Vladimir region. Analyses of Cloudflare Radar data put automated traffic from Yandex’s network about 94% below its late-September average on Oct. 11. Ukrainian President Volodymyr Zelenskyy said the strikes reduced pro-Kremlin bots online. Researchers say the data mostly reflects Yandex’s own web crawlers, not social-media bot farms, and no independent study has yet measured a drop in Russian influence operations.

What was hit, and what is confirmed

The Radio Free Europe/Radio Liberty reported that Ukraine struck three Yandex data centers in recent days, disrupting ride-hailing, payments, food ordering, cloud computing and chatbot services. According to a timeline compiled by the Ukrainian tech outlet Mezha, drones damaged the Sasovo facility on the night of Oct. 7–8, and Yandex said it had to be shut down completely. A Kaluga-region site was hit the next morning, knocking part of its infrastructure offline. On Oct. 11, Yandex said its Vladimir facility had also been attacked and shut down. Euronews reported that Yandex confirmed operations in Vladimir were suspended.

The outages reached ordinary users. The Verge reported that most Yandex-operated systems still appeared to be offline after the latest strike, including the Yandex Pay payment service. Yandex Fintech head Dima Pirogov said in a statement that “we can’t yet give you a precise restoration timeline.”

The strikes are part of a long-range drone campaign against targets inside Russia; for background on the wider war, see our coverage of energy-ceasefire talks and Russia’s glide-bomb campaign.

The “bot drop” claim, and why researchers dispute it

Zelenskyy linked the strikes to a calmer internet. “There was less hate, less division, and fewer provocations because there were fewer bots — and it’s pretty clear where those bots were coming from,” he said, as quoted by RFE/RL.

The figures behind the claim come from Cloudflare Radar, which tracks traffic by network. According to Mezha, a British analysis by Valdrans compared hourly data with the Sept. 14–30 average and found traffic on Yandex’s main network down about 25% on Oct. 8, 35% on Oct. 9–10 and 94% on Oct. 11. Human traffic on Oct. 11 was about 90% below baseline, and Yandex Cloud traffic was down 82%. Cybernews reported that automated traffic fell to 0.4% of its two-week peak before it began recovering on Sunday, Oct. 11.

Social-media users in Germany, Britain and the United States then posted that they were seeing less activity from accounts promoting Germany’s AfD party, Reform UK and the MAGA movement. Czech member of the European Parliament Tomáš Zdechovský shared one such chart about AfD activity, according to The Verge. Euronews reported that no independently verified figures have emerged to support those claims.

Researchers point to what the chart actually measures. Cloudflare’s figure counts HTTP requests from AS13238, a network operated by Yandex, that are estimated to be automated. The Japanese tech site XenoSpectrum, quoted by RFE/RL, wrote that the data “shows neither the volume of Internet traffic across Russia nor the number of messages posted on any particular social network.” The troll-farm tracking group antibot4navalny said the chart “has nothing to do with social media,” The Verge reported. The Verge added that, according to Cloudflare, bot activity from Russia at large stayed largely unchanged around the attacks. Experts quoted by Cybernews said covert troll farms usually hide behind residential proxies, hacked devices, VPNs and Western cloud providers rather than a single Russian company’s servers.

Bottom line: the strikes and the Yandex outage are confirmed. A drop in Russian social-media influence operations is claimed by Zelenskyy and by social-media users, but it has not been shown by independent data, and the strikes cannot be credited with one.

Russia’s documented bot and propaganda networks

The debate drew attention because Russian influence networks are well documented. In July 2024, the U.S. Justice Department said it had disrupted an AI-enhanced bot farm organized in 2022 with help from a senior editor at the state-funded broadcaster RT. Authorities seized two domains and searched 968 accounts on X. A joint advisory from U.S., Dutch and Canadian agencies said the software, called Meliorator, created fake personas that pushed content about the United States, Poland, Germany, the Netherlands, Spain, Ukraine and Israel.

In September 2024, the Justice Department seized 32 domains tied to the “Doppelganger” campaign. It alleged that the Russian firms Social Design Agency, Structura and ANO Dialog, working under the Russian Presidential Administration, used look-alike news sites, paid ads and fake profiles to reduce support for Ukraine and influence voters.

A newer tactic aims at search engines and AI tools rather than people. NewsGuard reported that the Moscow-based “Pravda” network, first identified by France’s Viginum agency in February 2024, published about 3.6 million articles in 2024 across roughly 150 domains, citing the American Sunlight Project. NewsGuard found that leading chatbots repeated the network’s narratives in about a third (33.55%) of its test prompts, even though individual sites drew few human visitors.

Iran’s IRGC-linked influence operations

Iran runs its own campaigns. The Microsoft Threat Analysis Center reported in February 2024 that after the Hamas attack on Israel on Oct. 7, 2023, Iranian government-aligned groups ran cyberattacks and influence operations “intended to help the Hamas cause.” Microsoft counted 11 cyber-enabled influence operations in October 2023 alone, compared with roughly one every other month in 2021. It described networks of “sockpuppet” accounts on X, an operation using an apparently AI-generated news anchor that interrupted streaming TV in the UAE, UK and Canada, and personas such as “Cyber Avengers” that Microsoft assessed as likely run by the IRGC. Microsoft also measured a 42% jump in traffic to Iranian state-affiliated news sites in the war’s first week.

Pro-Palestinian-themed fake account networks

Documented coordinated inauthentic activity using pro-Palestinian messaging has largely been traced to state actors rather than grassroots groups. Microsoft reported that Iranian operatives impersonated the military wing of Hamas and posed as peace activists to spread messaging aimed at weakening international support for Israel. In August 2024, OpenAI said it banned ChatGPT accounts tied to the Iranian operation known as Storm-2035, which produced articles and comments mainly about the conflict in Gaza, Israel’s presence at the Olympics and the U.S. election. OpenAI said it found a dozen X accounts and one Instagram account posing as both progressives and conservatives, and saw “no indication that this content reached a meaningful audience.” The Meliorator advisory also listed Israel among the subjects of Russia’s bot content. Ordinary activism on the conflict is not covered by these findings.

What to watch

Key open questions are when Yandex restores service, whether Cloudflare or independent researchers such as DFRLab, Graphika or the Institute for Strategic Dialogue publish data on social-media bot activity during the outage, and whether platforms report any change in takedowns. The Boston Report will update this story as verified data becomes available. For related coverage, see our report on Russian election-influence allegations in Brazil.

Sources

Additional sources

Featured graphic: The Boston Report.

Ukraine’s Strikes on Yandex Data Centers Spark Debate Over Russian Bot Farms and the Wider Information War