Ukrainian drone strikes on three Yandex data centers this month caused widespread disruption to Russian internet services, but researchers and fact-checkers have found no evidence that they silenced Russian propaganda networks on Western social media, contrary to viral claims that circulated after the attacks.
The strikes
The attacks came in response to a Russian campaign against Ukrainian data centers. Since late September, Russian missiles and drones have damaged or destroyed data centers belonging to at least eight Ukrainian companies, and Russia’s Defense Ministry described the campaign as “a forced digital detox.” The Ukrainian Digital Transformation Ministry said around 100,000 households in the Kyiv region lost internet access after the first strikes.
On October 8, Ukrainian drones hit Yandex’s data center in Sasovo, in the Ryazan region, which reportedly housed two of the company’s three supercomputers. The following night, a facility in Kaluga was struck, and several modules were knocked out. On October 11, Yandex said operations at its data center in the Vladimir region had been completely suspended after a drone attack. In total, three of Yandex’s six data centers were hit. On October 14, Ukraine also struck a Sberbank data center under construction in the Saratov region.
The damage inside Russia was significant. Users reported outages in Yandex Mail, Pay, Disk, Go and other services, and Yandex Cloud clients were also affected. Websites of other companies and media outlets operated with restrictions. Internet monitor NetBlocks measured connectivity on the Yandex Cloud network at about 30% of normal levels and on Yandex LLC’s network at 63%. Meduza reported that a full recovery is likely to take months.
The viral claim
The claim that Russian bots had been silenced originated with a chart from Cloudflare Radar, a public internet traffic dashboard, showing that automated traffic from a Yandex network (AS13238) had fallen to 0.4% of its two-week peak. Tech outlet Tom’s Hardware reported that Russian disinformation bot traffic had been nearly eliminated overnight.
Claims soon followed that online activity around Germany’s Alternative for Germany (AfD), the US MAGA movement and Britain’s Reform UK had collapsed. Speaking at the Warsaw Security Forum on October 12, Ukrainian President Volodymyr Zelensky said the strikes had made it “a little easier to breathe” on social media platforms, with less hatred, division and provocation because there were fewer bots. Czech MEP Tomáš Zdechovský shared a chart showing AfD-related activity falling by 30% and then 56%, which reached millions of views and was repeated by French daily Le Parisien.
What the chart measured
AS13238 is a network that Yandex lists in its own technical documentation for its bots, and those bots are mostly the company’s search crawler, software that indexes web pages for its search engine. Google operates a similar crawler. Such programs do not post, comment or imitate users on social media. When Yandex’s servers went down, its crawler went down with them.
Cloudflare’s head of Radar, Lai Yi Ohlsen, said “bot traffic” in the dashboard refers to automated requests to websites, not activity on social media platforms. Cloudflare’s own analysis found that the YandexBot crawler fell by 99% on October 11 and has since recovered to about 85% of normal levels. Bot traffic from Yandex Cloud fell by about 40%. Malicious automation, however, moved to other Russian hosting providers such as Radist and Selectel. Russian bot traffic targeting one gambling-sector client rose from 167.7 million to 170.1 million requests over the week. Russian-origin traffic to social media platforms fell by 0.6%, while automated “post,” “reply” and “like” actions on one platform decreased by 5.7%. Cloudflare said it could not rule out a connection entirely without data from outside its network.
No decline in Western debates
Graphika, which maps online communities, tested the main claims against its data. On October 11, AfD-related accounts published 40,365 posts from 1,022 accounts, compared with 42,040 posts from 1,037 accounts a week earlier. Graphika said the 4% dip was within normal range, as the community’s Sunday activity had varied by up to 38% over the previous 11 weeks. The viral AfD chart also showed no rise on September 6, when Saxony-Anhalt held its state election, even though real AfD activity increased by 42% that day. Mentions of MAGA on X rose 25% in the hours after the Vladimir strike. A chart showing a “collapse” in mentions of Anthony Fauci started from a spike caused by Sen. Rand Paul’s release of Fauci’s diary entries the previous day. Graphika also found that moving the comparison window in viral Reddit tables by a few hours turned a 54% decline into a 109% increase.
German researchers reached the same conclusion. The Center for Monitoring, Analysis and Strategy (CeMAS) said the AfD chart’s data could not be verified and was suspected to be AI-generated, although this has not been confirmed. CeMAS director Josef Holnburger told ZDF he saw no decline in Russian disinformation campaigns that could be explained by the strikes. US-based monitoring group dTeam told BBC Verify that traffic from known Russian accounts and bot clusters had not changed on any platform, and that operations such as Storm-1516 and Matryoshka remained active. Zelensky’s office later told the BBC that the president had been referring to the atmosphere on social media rather than a measured fall in bot activity.
Pro-Israel claims about Palestine
A similar claim spread among pro-Israel accounts, which shared charts purporting to show posts containing “Free Palestine” falling from about 70,000 a day to about 30,000, and mentions of “genocide” falling from a peak of about 280,000. The claim was that Russian bots had been driving anti-Israel content online. Israel Hayom reported similar figures, and the story was discussed on US cable television.
Jewish Breaking News, which posted the charts on Instagram, acknowledged that they counted keyword mentions rather than Russian bots. The charts covered October 5 to 11, a period that included the third anniversary of the October 7 attack, when such mentions rise every year before falling back. Researchers also noted that some of the graphs ended on an incomplete day. Israel365 News concluded that the anti-Israel accounts had kept posting.
Where activity did decline
Graphika did find declines in Russian-speaking spaces. Russian-language Telegram channels posted 5% to 15% less in the two days after the Vladimir strike, while Ukrainian, Iranian and Romanian channels showed little change. On Reddit, activity in r/askarussian, a forum where Russians answer questions from foreigners, fell after all three strikes. Graphika said internet disruption inside Russia was one possible explanation.
Ukraine’s Center for Countering Disinformation (CCD) reported a sharper effect. Using Osavul software, it analyzed 22,664 messages from 5,201 accounts showing signs of inauthentic behavior in Ukraine’s information space between October 6 and 12. On October 8, messages fell from 4,032 to 660 and active accounts from 1,526 to 258, a drop of about 84%. Activity recovered within two days and exceeded pre-strike levels by October 10 and 11. After the Vladimir data center was shut down, messages fell again by 42.6% on October 12. The partial damage in Kaluga did not coincide with a decline. The CCD findings cover networks targeting Ukraine rather than Western audiences.
CeMAS also reported that it had not observed German-language activity by the Doppelgänger operation on X since October 9, though it said this could not yet be linked to the strikes. Leaked internal documents from Moscow’s Social Design Agency, a firm behind many Russian disinformation campaigns, contained links to Yandex Cloud, where screenshots of campaigns were stored. CeMAS said it was plausible that individual operations relied on Yandex services, but that a complete shutdown of their activity across platforms was unlikely.
The wider impact
Analysts say the strikes exposed a structural weakness in Russia’s digital infrastructure. Because Russia has developed a closed internet, there are no data centers abroad to fail over to. After the second strike, Yandex reached short-term agreements with competitors VK Cloud, K2Cloud and Selectel to move affected services and clients onto their infrastructure. Western technology sanctions are also expected to make it harder to replace damaged equipment, particularly GPUs.
What the episode shows
Russian influence operations are real and well documented, which is part of why the Yandex story spread so easily. CeMAS attributed its spread to misunderstanding of what “bots” are and to wishful thinking and pointed to confirmation bias: the tendency to look for information that confirms what one already believes. Graphika found that the claim was shared mostly by pro-Ukraine audiences, not by the communities it said had been silenced. Researchers recommend a few simple checks before sharing such claims: what a chart counts and on which platform, whether it compares the same days and hours in earlier weeks, and whether unrelated communities changed by the same amount. Countering Russian disinformation depends on accurate evidence and claims that confirm what audiences want to believe deserve the same scrutiny as those that do not.