Ukraine knocked out Russia’s biggest tech company. Did it knock out the trolls?

Ukraine’s strikes on Yandex set off claims that Russia’s troll farms fell silent. Researchers can’t find the collapse.

Between October 8 and 11, Ukrainian drones hit three Yandex data centres in Sasovo, Kaluga and Vladimir. Dozens of cloud services run by the company often called Russia’s Google went offline, payments stalled, and the monitoring group NetBlocks recorded connectivity at a fraction of normal levels.

After the October 11 strike on Vladimir, Cloudflare Radar showed automated traffic from one Yandex network at 0.4 percent of its two-week peak, and the chart spread as evidence that Russia’s troll farms had gone offline with the servers. President Zelensky, speaking at the Warsaw Security Forum, saw “less hate, less division” online. Czech MEP Tomáš Zdechovský shared a graphic claiming activity linked to Germany’s far-right AfD had fallen by as much as 56 percent; his post drew more than four million views and remains pinned to his profile.

Cloudflare counts automated web requests, and most of the traffic that vanished came from search-engine crawlers indexing pages. The Austrian fact-checkers at Mimikama found the AfD graphic named no source, platform or method and carried figures for October 15, a date still in the future when it circulated; a computer scientist told The Verge the image looked AI-generated. BBC Verify saw the Storm-1516 and Matryoshka operations posting through the outage, and Zelensky’s office later said he was describing the atmosphere online.

Repsense research

We checked the claim against Lithuanian social media. Repsense scores 16,000 to 18,000 posts and comments a day across seven platforms for pro-Russian risk, and during the outage the high-risk volume rose, not fell – from about 1,400 items a day before October 7 to about 2,400 on October 10–11, up 71 percent, with the average risk score peaking in the same hours Cloudflare showed the collapse. The climb began in early October, before the first strike, so the attacks did not cause it either.

Users still reported calmer feeds, and we see two explanations: confirmation bias, where a viral chart told people the bots were gone and every quiet moment became proof; and the platforms’ algorithms, which rank the posts and comments each user sees, so a feed can turn calmer because different content was surfaced, not because less of it was written.

“We’d all like to believe that, like Luke Skywalker, Zelensky could bomb a data centre and free us from foreign influence and troll campaigns. Unfortunately, that’s not how it works yet.”

— Mykolas Katkus, CEO of Repsense

Influence operations run on residential proxies, mobile devices and rented servers spread across many countries, so one downed data centre leaves the other routes open. Cloudflare’s broader data showed automated traffic from Russia as a whole remained largely stable, and Euronews noted the figures offered no evidence of a collapse.

The US urged allies to quit Europe’s top disinformation conference. The EEAS, Canada and Lithuania pulled their logos.

Three government logos were covered with tape on the banners of #Disinfo2026 when the conference opened in Vilnius on October 7. The European External Action Service, the EU’s diplomatic arm, Canada and Lithuania had withdrawn their names from Europe’s main gathering of disinformation researchers days before it began.

Three people familiar with the matter told the Guardian the US State Department had contacted multiple governments about their support for the conference, with some communications appearing to come from the office of Sarah B Rogers, the undersecretary for public diplomacy. Internal State Department documents seen by the paper show US officials thanking Lithuania for “taking US concerns seriously” and welcoming its decision to limit involvement. The panel that drew Washington’s attention, titled “USA as a FIMI threat: adapt, acknowledge, push back”, asked whether the United States can itself be considered a source of foreign information manipulation in Europe, a question the conference programme called one of the most uncomfortable in the field; it went ahead on Wednesday with three American speakers, among them a former CIA officer.

The EEAS said it asked for its logo to be removed because parts of the programme did not align with official EU positions; its researchers still presented at the event, and the EU continues to fund it. Canada’s foreign ministry revised its participation in specific sessions rather than leaving. France stayed on as the only government sponsor and said it backs the conference because countering information manipulation depends on civil society.

The State Department said it could not comment on diplomatic conversations, and that countries should not be expected to stay affiliated with a conference that labelled the US a “FIMI threat”, a term it noted is normally reserved for adversaries’ influence operations.

Poland says Russia tried to spread panic after deadly school stabbings

A 19-year-old injured nine people with a machete-like knife at a school in Ostrołęka, northeast of Warsaw, on October 7. The next day a 15-year-old former pupil stabbed staff at a primary school in Leszczydół-Nowiny, killing a 37-year-old caretaker; officials believe the helmet camera he wore was meant to record the attack. On October 10, a woman injured three people at an educational institution in Warsaw. All three attacks happened in the Mazovia region, and investigators found no link between them.

Rumours of a coming “Bloody Friday”, a coordinated wave of attacks stemming from a supposed online challenge, spread through parents’ chat groups and the media. The Wyszków municipality closed its primary schools and kindergartens on Friday, and other schools across the region cancelled classes or moved online. Defence Minister Władysław Kosiniak-Kamysz said military cyber defence forces had recorded a major disinformation campaign on the evening of October 8, built to spread panic. He did not tie Russia to the attacks themselves, but called exploiting crises a standing feature of Moscow’s strategy – “they see a crisis situation and immediately exploit it” – and recalled false claims that hundreds had died during Poland’s 2024 floods.

Tomasz Siemoniak, the minister coordinating Poland’s special services, said police, intelligence agencies and the state research institute NASK are examining who amplified the scare.

MI5 puts countering cognitive warfare on the same footing as terrorism and state threats

Ken McCallum, the director general of MI5, Britain’s domestic security service, delivered his annual threat update at the agency’s London headquarters on October 13 and announced a third core mission. National resilience, which he defined as protecting critical infrastructure, countering cognitive warfare and addressing technology threats, now sits alongside counter-terrorism and state threats at the top of the service’s work, Politico reported.

The service’s state-threats caseload has quadrupled in a decade, and MI5 now devotes more resources to it than it did during the Cold War, a level McCallum said is not temporary. He called Russia the number one aggressor, running sabotage, cyberattacks and disinformation below the threshold of open war.

A new AI Threat Assessment Centre, built with the AI Security Institute, the National Crime Agency and the National Cyber Security Centre, is meant to “separate the bluster from the realities” of AI threats. McCallum added that AI can already produce propaganda and radicalising material tailored to a single reader.

McCallum also addressed claims of Russian interference in the Brexit referendum: the attempts are a matter of public record, he said – Russian media pieces, internet trolls and bot farms – but there is a difference between attempted interference and a changed outcome, and said he worries about playing into Moscow’s hands “by making these trolls look 10ft tall”. Russia’s government denies interfering.

A campaign run from Riga pays people worldwide to pose as Republican-supporting Americans

The Atlantic reporter Ali Breland joined the Discord server of Elephant Clipping, a campaign run from Riga by a company called ClipIt, and watched its mechanics from the inside. The operation, described in an investigation published on September 2, pays people around the world to post short pro-Republican videos on TikTok, Instagram Reels and YouTube Shorts from accounts built to look like those of ordinary Americans.

The man running it, who goes by Serviuos, tells participants unfamiliar with US politics to ask Gemini or ChatGPT for pro-Republican video ideas, and states the goal plainly: he wants Republicans to win in the US. Clippers share a monthly budget of $300,000, with every million views paying $300, and are instructed to use US proxy servers and hide their real locations. The operation aims at a billion views a month and, by its own unverified updates, regularly reaches hundreds of millions a week.

“You can literally make 100k a month with this campaign.”

— Serviuos, in a video recruiting clippers

The Discord does not name the funder. Campaign video folders, though, were uploaded by employees of Enclave & Key, a Las Vegas marketing firm founded by Blake Wynn, a nephew of the casino billionaire and Republican mega-donor Steve Wynn; related campaigns promoted Vivek Ramaswamy and Tulsi Gabbard. After The Atlantic sent its questions, folders and campaign listings began disappearing.

Isabel Linzer of the Center for Democracy and Technology, a Washington think tank, said political clip farms at this scale had been suspected but never confirmed, and a campaign-finance expert told the magazine no disclosure rules clearly cover such campaigns. Enclave & Key called itself an American company and the practice routine, longstanding and lawful.