No Decline in Pro-Russian Content After the Yandex Strikes: Evidence from Lithuania and France
“We'd all like to believe that, like Luke Skywalker, Zelensky could bomb a data centre and free us from foreign influence and troll campaigns. Unfortunately, that's not how it works yet.”
Ukrainian drone strikes on three Yandex data centres between 8 and 11 October disrupted parts of Russia’s digital infrastructure. As Cloudflare Radar recorded a sharp fall in automated traffic from Yandex’s network, a broader claim began to circulate: that the strikes had also disabled Russian influence operations on social media. Repsense tested this claim against social media content in Lithuania and France, covering about 1.4 million posts and comments scored for pro-Russian risk. In neither country did high-risk content decline.
Three strikes expose Russia's digital vulnerabilities
Between October 8 and 11, Ukrainian drone strikes hit three major Yandex data centres in Russia, located in Sasovo, Kaluga and Vladimir. Often described as Russia's equivalent of Google, Yandex operates a vast digital ecosystem spanning cloud computing, online retail, transport, deliveries and financial services.
According to Tom's Hardware, at least 84 Yandex Cloud services were reported offline. On October 11, internet monitoring group NetBlocks recorded connectivity falling to 30% of its reference level for Yandex Cloud and 63% for Yandex LLC. Businesses and ordinary users felt the consequences. Applications became inaccessible, cloud services were disrupted and Yandex Pay customers struggled to make payments or check balances.
Recovery may prove difficult. Western sanctions have restricted Russia's access to advanced technology, while Carnegie Endowment research estimates that its domestic chipmaking capabilities already lag roughly 15 years behind the United States.
The economic consequences should not be underestimated. Yet on social media, the strikes were already being credited with another, far less substantiated achievement: crippling Russia's online influence operations.
Did Ukraine accidentally unplug Russia's troll farms?
Following the attacks, Cloudflare Radar showed automated traffic originating from Yandex's network dropping almost to zero for approximately twelve hours on October 10. The conclusion practically wrote itself: Ukraine had bombed Yandex, and Russia's propaganda bots had disappeared.
Social media users celebrated apparent reductions in suspicious activity on X and Reddit. Some connected the outage to declining online activity associated with European far-right movements. Czech MEP Tomáš Zdechovský shared a chart suggesting sharp declines in activity linked to Germany's far-right Alternative for Germany (AfD), with figures indicating drops of 30% and 56%.
Tomáš Zdechovský Shares Unverified Chart Linking Yandex Outage to Decline in AfD Online Activity
The theory spread quickly: Ukraine had supposedly dealt a devastating blow to the Kremlin's influence operations. There was a certain poetic appeal to it. Years of arguments about online manipulation, apparently solved with a few drones. But one basic question remained: what exactly was Cloudflare measuring?
A bot is not necessarily a troll
The Cloudflare figures measured automated website requests originating from a particular Yandex network, not Russian propaganda accounts posting on social media. Much of this traffic came from web crawlers: automated programs that visit websites and index content for search engines. Google, Bing and Yandex all use them. A web crawler indexing a news article is not the same thing as a fake Facebook account posting Kremlin talking points underneath it.
The investigative group antibot4navalny, which tracks Kremlin-linked bot networks, challenged the viral interpretation. Cloudflare's broader data showed that automated traffic from Russia as a whole remained largely stable. As Euronews pointed out, the figures offered no evidence of a collapse in Kremlin-linked social media accounts.
More questions emerged around a chart shared by Zdechovský. According to Austrian fact-checking group Mimikama, the graphic identified no data source, platform or measurement method. It circulated on October 11 but included figures for future dates, including October 15 (apparently, the bots weren't the only ones working overtime). Computer scientist Raphael Wimmer told The Verge he suspected the image was AI-generated. Its earliest known version reportedly made no mention of the AfD.
Cloudflare recorded a real fall in Yandex's automated traffic, but that traffic came mostly from search-engine crawlers. Shutting down data centres is not the same as shutting down disinformation networks.
“We'd all like to believe that, like Luke Skywalker, Zelensky could bomb a data centre and free us from foreign influence and troll campaigns. Unfortunately, that's not how it works yet.”
— Mykolas Katkus, CEO of Repsense
Why did the bots seem to disappear?
Some users who reported quieter feeds after the strikes were probably describing a real experience. The difficulty is that a feed is a poor measuring instrument. Platforms rank replies by engagement and relevance, so two people reading the same post can see different conversations beneath it. Fewer hostile comments near the top of a thread says little about how many were posted further down, or under other posts.
Expectations play a part too. Once the story of unplugged troll farms had spread, a calm comment section could look like confirmation, even to readers with no clear sense of how busy it had been the week before. Ranking systems and expectations reinforce each other. That is why sincere personal observations cannot replace systematic measurement.
Comments on the French Instagram accounts we monitored show how mixed those observations were. On 12 October, some users under French news posts thanked Zelensky for clearing the “racist bots” from their feeds. Over the same days, others complained that the comments were full of pro-Russian bots.
We checked. Russian disinformation was doing just fine.
Repsense tested the viral claim in two information environments: Lithuania and France. If the strikes had disrupted pro-Russian influence operations, high-risk content should have fallen during the outage. It did not fall in either country.
Lithuania: high-risk content rose 71%
By October 10–11, the daily volume of high-risk posts and comments stood 71% above the earlier baseline. During the hours when Cloudflare recorded a collapse in automated traffic from Yandex networks, the average risk score reached its highest level since October 1.
Repsense analysisThe outage versus the narrative
What the viral claim measured, and what Repsense measured.
On Facebook, the proportion of the most extreme comments increased without a corresponding rise in overall activity. On Telegram, the tone of reactions shifted while their volume remained stable.
Importantly, the upward trend began in early October, before the first drone strike. The findings therefore do not suggest that the attacks caused an increase in pro-Russian content.
Repsense analysis · LithuaniaPro-Russian content in Lithuanian social media rose through the strike week
High-risk (7–10) pro-Russian posts and comments per day, 14 Sep – 11 Oct 2026, all platforms. The rise began in early October, before the strikes, so we do not attribute it to them. The strikes did not interrupt it either.
France: no dip during the outage hours
In France, we analysed scored content from X, Facebook, Telegram, Bluesky, YouTube, Instagram, TikTok and the web. During the first strike days, 7–9 October, high-risk content held steady. About 705 posts and comments a day scored 7–10, against 732 in the week before. On 10–11 October, the figure rose to about 1,190 a day, 63% above that baseline.
The outage hours tell the same story. Cloudflare recorded near-zero automated Yandex traffic from about 13:00 UTC on 10 October to 01:00 UTC the next day. In those twelve hours, 4.6% of scored content was high-risk. In the same hours on earlier days, the share was 2.4%.
Repsense analysis · FranceFrance: no drop after the strikes
Share of scored posts and comments rated 7–10 for pro-Russian risk, per day, 29 Sep – 11 Oct 2026. The strike days stay inside the normal range. The rise comes on 10–11 October, including the hours when Cloudflare showed Yandex traffic near zero.
- 1Strike on Sasovo data centre, night of 7–8 Oct
- 2Strike on Kaluga, 9 Oct
- 3Cloudflare gap, 10 Oct 13:00 – 11 Oct 01:00 UTC
- 4Vladimir shut down, announced 11 Oct
Every platform with meaningful volume showed a higher high-risk share on 10–11 October. Scores for disinformation risk and overall harm potential did not rise with it. That pattern fits a change in what people were discussing.
We also examined 34,812 posts and about 297,000 sampled comments from 1,669 French Instagram accounts covering politics and news. After adjusting for account, post age and weekday, comments per post on 10–12 October were within 1% of their 9–27 September level.
One bot-like network did go quiet. A commercial spam operation promoting adult websites left more than 9,700 templated comments in our sample, from about 7,600 throwaway accounts. It stopped in the early hours of 8 October and returned on 11 October under two new domains, reusing the same wording. Its comments contained no political content, and nothing in the data links its pause to the strikes.
The news cycle explains the rise
In both countries, the 10–11 October rise coincided with a busy news cycle on Russia and Ukraine. On 9 October, Donald Trump announced a diesel deal with Vladimir Putin. A day later, he said Ukraine needed a new leader. In France, the share of Instagram captions mentioning Russia or Ukraine rose from 2.0% on 8–9 October to 5.5% on 10–11 October, closely tracking the high-risk share. In Lithuania, the most-reacted Telegram posts that week also covered the Trump–Putin deal and Trump’s exchange with Zelensky.
Repsense analysis · FranceFrance: the 10–11 October rise coincides with Russia and Ukraine in the news
The two shares move together: when Russia and Ukraine are in the news, more posts and comments are rated high-risk. The 10–11 October rise follows the news cycle rather than a return of bots (daily rank correlation 0.54).
Across the Lithuanian and French information environments we monitored, pro-Russian content did not fall silent. It continued circulating, with the highest-risk activity growing rather than shrinking.
Why Russian influence operations don't need Yandex to survive
The misunderstanding reveals something important about how Russian influence operations work. They are not one enormous bot farm plugged into a single server room. A 2020 US State Department report identified five pillars of Russia's disinformation ecosystem:
official communications,
state-funded media,
proxy sources,
weaponised social media,
cyber-enabled disinformation.
These channels reinforce one another, allowing narratives to circulate across platforms and audiences.
In practice, the system can be understood through three overlapping layers. State-linked media and government channels establish strategic narratives. Intermediaries, including Telegram channels, commentators and local influencers, adapt them to domestic contexts. Coordinated accounts, artificial engagement and comment campaigns amplify their reach.
How Russian influence operations work
One narrative, many routes
A state narrative is localised on Telegram, seeded by local voices and amplified by coordinated accounts. The infrastructure underneath is spread across many kinds of connection.
Operators can switch between these routes, so taking one data centre offline leaves the others running.
Illustrative model, not measured data. Sources: US State Department Global Engagement Center, Pillars of Russia's Disinformation and Propaganda Ecosystem (2020); Repsense analysis.
Much of this requires surprisingly little computing power. Operators can use residential proxies, mobile devices and rented servers located anywhere in the world. These arrangements also help evade detection, as platforms may flag suspicious traffic originating from major data centres.
Even generating thousands of AI-assisted comments need not require sophisticated infrastructure. Carefully coordinated engagement can sometimes help content gain visibility, depending on platform algorithms. A troll farm does not necessarily live in a farm-sized data centre.
None of this diminishes the importance of the Yandex strikes. Disruptions to its infrastructure may affect how information is indexed, discovered and distributed, alongside the broader economic costs. But disrupting the infrastructure through which information is found is not the same as disrupting the actors who manipulate it.
Before celebrating the victory
Ukraine's strikes exposed genuine vulnerabilities in Russia's technological infrastructure. But the supposed collapse of Russian propaganda bots was a different story, built around a misleading interpretation of technical data and amplified by an unverified graphic.
There is an uncomfortable irony here: an unverified claim about online manipulation gained traction through the very platforms it purported to explain. The apparent disappearance of bots became a story in its own right, reinforced by selective observations and the algorithms shaping what users could see.
Understanding influence operations requires examining content, actors and networks, rather than treating every movement in internet traffic as a measure of propaganda.
Our findings in Lithuania and France point to a less satisfying conclusion: pro-Russian content did not fall silent. High-risk activity increased in both countries, and the narratives continued circulating. Disrupting Russia’s digital infrastructure is a significant achievement. Disrupting its influence operations is a different challenge altogether.
Methodological note
Why Lithuania and France. Repsense already tracks FIMI and disinformation in the social media of both countries on a continuous basis, which allowed the claim to be tested on data collected on the same days it was made. The two countries also represent contrasting cases: Lithuania is a small information space that Russian operations target heavily, while France is a large Western European one. If the strikes had disrupted pro-Russian activity, at least one of the two would be expected to show it.
Data. In Lithuania, the analysis covers about 458,000 posts, comments and videos collected between 14 September and 11 October 2026 from nine platforms: Facebook, Telegram, YouTube, TikTok, Instagram, Reddit, Discord, X and Bluesky. In France, it covers about 920,000 French-language posts and comments collected between 1 September and 11 October 2026 from seven social media platforms (X, Facebook, Telegram, Bluesky, YouTube, Instagram and TikTok) and the open web. A second French dataset, a panel of 1,669 French politics, news and commentary accounts on Instagram, adds 34,812 posts and 297,334 comments published between 9 September and 12 October 2026.
Scoring. Each collected item was scored automatically by Havel, Repsense’s AI model for content analysis, on a pro-Russian risk scale from 1 to 10. The scale measures how strongly content promotes pro-Russian or pro-Kremlin narratives. A score of 1 is given to content unrelated to Russia or critical of it, and a score of 10 to content that repeats a Kremlin line as fact. The score rises when content repeats Kremlin narratives about the country, NATO or Ukraine, blames the West or Kyiv for the war, presents sanctions or defence spending as self-harm, passes off unverified or distorted claims as fact, or stirs hostility toward the state or its allies. Items scored 7–10 were classified as high risk. Repsense analysts review samples of the automated scores as part of ongoing quality assurance.
Limitations. The French Instagram panel carries no risk score and was analysed for volume and content only. The analysis measures pro-Russian risk signals, not verified bot activity or the number of Kremlin-controlled accounts. It cannot establish whether individual bot networks were disrupted or attribute changes in content activity to the strikes. Findings are limited to the monitored Lithuanian and French information environments. The test windows are short, so the findings show the claim is unsupported by the data, but they cannot disprove it.
Explore how Repsense maps the information environment.
