Russian tech giant Yandex absorbed punishing blows last week. Ukrainian drones struck three of its data centers in rapid succession. The facilities in Sasovo, Kaluga and Vladimir went offline. Services that millions of Russians rely on for maps, payments, taxis and cloud storage faltered. Yet the story that captured global attention had little to do with those everyday disruptions.
Social media lit up with claims of victory. Russian bots had gone silent, users insisted. President Volodymyr Zelenskyy suggested the strikes had dealt a blow to pro-Kremlin disinformation campaigns. Charts from Cloudflare Radar appeared to back the narrative. Automated traffic from Yandex networks plunged to near zero. Observers celebrated what looked like a rare success in the information war.
But the data told a more nuanced tale. A detailed analysis released Wednesday by Cloudflare shows the drop reflected something narrower. Legitimate search crawlers vanished. Malicious automation did not. Instead, it migrated. The bots moved to other Russian hosting providers within hours. Their fingerprints remained identical.
Cloudflare’s report, titled “Yandex outage: data shows that instead of going dark, malicious bots went on the move,” lays out the evidence with precision. Cloudflare Blog Between October 7 and 11, strikes progressively took capacity offline. Traffic from AS13238, Yandex’s primary search network, fell 99 percent below baseline by October 11. AS200350, the cloud segment, dropped 90 percent. Recovery proved slow. Even by October 14, levels sat 15 percent below normal.
That collapse hit verified crawlers hardest. These automated systems index pages, images and resources for Yandex Search. They account for the vast majority of the lost requests. “The drop in traffic consisted almost entirely of verified search crawlers,” the report states. High-volume malicious activity on the cloud side followed a different path.
One gambling operator offered the clearest case study. Nearly all bot requests from Yandex.Cloud targeted a single customer account. When the October 8 disruption hit, those requests stopped cold. Identical patterns surfaced immediately from other Russian autonomous systems. The same JA4 fingerprint. The same uncommon URL paths and headers. The same custom User-Agent strings. Migration happened in real time. No pause in the flood.
Overall numbers reinforce the point. Global bot requests as a share of all HTTP traffic held steady around 39.5 percent before and after the strikes. Russia-origin bot traffic dipped modestly from a pre-event baseline of 50.4 percent but never collapsed. Requests aimed at gambling accounts actually rose slightly, from 167.7 million to 170.1 million during the week of attacks. The operators adapted faster than the infrastructure failed.
Claims of a disinformation blackout never matched the telemetry. Mashable reported that while some interruption occurred, bot operators rerouted to alternative providers without missing a beat. Cloudflare analysts concluded their data “does not appear to support the claims that the strikes crippled social media manipulation.” They stopped short of total dismissal. Broader visibility beyond their network would be needed for certainty.
Renée DiResta, writing at Lawfare, highlighted the gap between perception and evidence. The visible drop came from Yandex’s own crawlers, not armies of social media accounts. Shrinking access to reliable data makes such distinctions harder. Initial excitement on platforms from X to Telegram rested on a misreading of what the charts actually measured.
Yandex itself scrambled to recover. Russia’s Digital Development Minister Maksut Shadayev told RBC that the government helped migrate core systems to backup sites. The company had long maintained distributed infrastructure, it insisted. Yet the strikes exposed vulnerabilities. Three of six major data centers took damage. Supercomputers used for training Yandex’s AI models sat inside affected facilities. Services from Alice voice assistant to Yandex Pay suffered prolonged outages. Retail giants that relied on its cloud felt the pain.
Physical attacks on data centers carry real costs. Ordinary Russians faced delays ordering food, hailing rides and accessing funds. Businesses lost temporary access to storage and compute. Restoration dragged on for days. Some features remain limited even now. But the automation that powers scraping, scanning and coordinated influence proved portable. Operators treat hosting providers as interchangeable. A few configuration changes and the traffic flows again.
This resilience should temper expectations. Decades of concern over Russian influence operations have focused on content farms, troll accounts and automated amplification. Those systems run on cheap, distributed resources. They adapt to network disruptions the way water finds a new path downhill. Taking out one provider changes the address, not the behavior.
Cloudflare observed declines in certain attack-like categories. Vulnerability scanning and probing fell on the cloud network. Yet the high-volume, persistent automation that targets specific services simply shifted AS numbers. The same patterns appeared on providers such as Radist and Selectel. Fingerprint matching left little doubt about the source.
Independent researchers echoed the skepticism. Accounts that track state-sponsored campaigns reported no measurable decline in coordinated activity on social platforms. The Cloudflare charts measured HTTP requests from specific Russian networks to websites across the internet. They do not track posts on X, Telegram or Facebook. The two are only loosely related.
So what does this episode reveal? Infrastructure concentration creates targets. Yandex dominates Russian search, mapping, ride-sharing and cloud services. Its data centers represent single points of failure for an entire digital economy. Ukrainian forces exploited that reality, responding to Russian strikes on their own data facilities. The tit-for-tat has escalated into direct hits on the backbone of online life inside Russia.
Yet influence operations sit one layer removed. They depend less on any single company’s servers than on access to the broader internet and armies of accounts. Migration takes minutes. New infrastructure absorbs the load. Global bot traffic percentages barely flickered. The machines kept working.
Future efforts to blunt disinformation may need to look beyond physical strikes. Platform-level defenses, better detection of coordinated behavior and reduced reliance on centralized Russian providers could matter more. For now, the bots demonstrated adaptability that outpaced the damage. They didn’t disappear. They simply changed addresses. And the traffic continued to flow.
WebProNews is an iEntry Publication