The Yandex Outage and the Myth of the Disappearing Russian Bots
“We'd all like to believe that, like Luke Skywalker, Zelensky could bomb a data centre and free us from foreign influence and troll campaigns. Unfortunately, that's not how it works yet.”
Ukrainian drone strikes on Yandex data centres brought parts of Russia's digital infrastructure to a standstill last week. But as reports emerged of a dramatic collapse in automated traffic from the tech giant's networks, a more ambitious claim began circulating: the strikes had also crippled Russia's notorious troll farms. The evidence was less convincing. Repsense examined social media activity in Lithuania to see whether the supposed decline was reflected in the content itself.
Three strikes expose Russia's digital vulnerabilities
Between October 8 and 11, Ukrainian drone strikes hit three major Yandex data centres in Russia, located in Sasovo, Kaluga and Vladimir. Often described as Russia's equivalent of Google, Yandex operates a vast digital ecosystem spanning cloud computing, online retail, transport, deliveries and financial services.
According to Tom's Hardware, at least 84 Yandex Cloud services were reported offline. On October 11, internet monitoring group NetBlocks recorded connectivity falling to 30% of its reference level for Yandex Cloud and 63% for Yandex LLC. Businesses and ordinary users felt the consequences. Applications became inaccessible, cloud services were disrupted and Yandex Pay customers struggled to make payments or check balances.
Recovery may prove difficult. Western sanctions have restricted Russia's access to advanced technology, while Carnegie Endowment research estimates that its domestic chipmaking capabilities already lag roughly 15 years behind the United States.
The economic consequences should not be underestimated. Yet on social media, the strikes were already being credited with another, far less substantiated achievement: crippling Russia's online influence operations.
Did Ukraine accidentally unplug Russia's troll farms?
Following the attacks, Cloudflare Radar showed automated traffic originating from Yandex's network dropping almost to zero for approximately twelve hours on October 10. The conclusion practically wrote itself: Ukraine had bombed Yandex, and Russia's propaganda bots had disappeared.
Social media users celebrated apparent reductions in suspicious activity on X and Reddit. Some connected the outage to declining online activity associated with European far-right movements. Czech MEP Tomáš Zdechovský shared a chart suggesting sharp declines in activity linked to Germany's far-right Alternative for Germany (AfD), with figures indicating drops of 30% and 56%.
Tomáš Zdechovský Shares Unverified Chart Linking Yandex Outage to Decline in AfD Online Activity
The theory spread quickly: Ukraine had supposedly dealt a devastating blow to the Kremlin's influence operations. There was a certain poetic appeal to it. Years of arguments about online manipulation, apparently solved with a few drones. But one basic question remained: what exactly was Cloudflare measuring?
A bot is not necessarily a troll
The Cloudflare figures measured automated website requests originating from a particular Yandex network, not Russian propaganda accounts posting on social media. Much of this traffic came from web crawlers: automated programs that visit websites and index content for search engines. Google, Bing and Yandex all use them. A web crawler indexing a news article is not the same thing as a fake Facebook account posting Kremlin talking points underneath it.
The investigative group antibot4navalny, which tracks Kremlin-linked bot networks, challenged the viral interpretation. Cloudflare's broader data showed that automated traffic from Russia as a whole remained largely stable. As Euronews pointed out, the figures offered no evidence of a collapse in Kremlin-linked social media accounts.
More questions emerged around a chart shared by Zdechovský. According to Austrian fact-checking group Mimikama, the graphic identified no data source, platform or measurement method. It circulated on October 11 but included figures for future dates, including October 15 (apparently, the bots weren't the only ones working overtime). Computer scientist Raphael Wimmer told The Verge he suspected the image was AI-generated. Its earliest known version reportedly made no mention of the AfD.
Cloudflare recorded a real fall in Yandex's automated traffic, but that traffic came mostly from search-engine crawlers. Shutting down data centres is not the same as shutting down disinformation networks.
“We'd all like to believe that, like Luke Skywalker, Zelensky could bomb a data centre and free us from foreign influence and troll campaigns. Unfortunately, that's not how it works yet.”
— Mykolas Katkus, CEO of Repsense
Why did the bots seem to disappear?
But what about users who claimed to have noticed fewer Russian bots in their feeds? They may genuinely have seen a change. The problem is that what appears on a social media feed is not necessarily representative of what is happening across the platform. Two mechanisms help explain the perception: confirmation bias and algorithmic curation.
The confirmation bias
Once people hear that Russian bot networks have supposedly been knocked offline, they may become more attentive to their apparent absence. A quieter comment section suddenly looks like evidence of a successful strike, even without knowing how active it was beforehand.
The algorithmic curation
Social media platforms do not show everyone the same content, or even the same comments beneath a post. Ranking systems determine which conversations become visible, using signals such as engagement and relevance. A decline in suspicious comments appearing near the top of someone's feed does not necessarily mean those comments have stopped being produced.
These mechanisms do not establish what individual users experienced after the strikes. They do, however, explain why personal observations, however sincere, cannot substitute for systematic measurement.
We checked. Russian disinformation was doing just fine.
At Repsense, we tested the viral claim against social media activity in Lithuania. If the strikes had disrupted pro-Russian influence operations, we might expect to see a corresponding decline in high-risk content. Instead, we found the opposite.
By October 10–11, the daily volume of high-risk posts and comments stood 71% above the earlier baseline. During the hours when Cloudflare recorded a collapse in automated traffic from Yandex networks, the average risk score reached its highest level since October 1.
Repsense analysis
The outage versus the narrative
What the viral claim measured, and what Repsense measured
Yandex automated web traffic
0.4%
Near zero · share of recent peak
After the 11 October strike. Mostly search-engine crawlers.
High-risk pro-Russian content
+71%
Daily average vs earlier baseline
About 2,400 posts and comments a day on 10–11 October, up from about 1,400.
Automated Yandex traffic fell to near zero. High-risk pro-Russian content in Lithuania rose.
The two figures use different metrics, populations and time windows. The comparison shows why Cloudflare data cannot establish a decline in social media influence activity. Sources: Cloudflare Radar via Tom's Hardware (57% of peak on 8 October, 0.4% after 11 October); Repsense monitoring.
On Facebook, the proportion of the most extreme comments increased without a corresponding rise in overall activity. On Telegram, the tone of reactions shifted while their volume remained stable.
Importantly, the upward trend began in early October, before the first drone strike. The findings therefore do not suggest that the attacks caused an increase in pro-Russian content.
Repsense monitoring, Lithuania
Pro-Russian content increased during the Yandex outage
Daily average of high-risk posts and comments (risk scores 7–10)
+71%
Increase in daily high-risk content compared with the earlier baseline
Source: Repsense monitoring, Lithuania, October 2026. Figures are approximate daily averages.
Across the Lithuanian information environment we monitored, pro-Russian content did not fall silent. It continued circulating, with the highest-risk activity growing rather than shrinking.
Why Russian influence operations don't need Yandex to survive
The misunderstanding reveals something important about how Russian influence operations work. They are not one enormous bot farm plugged into a single server room. A 2020 US State Department report identified five pillars of Russia's disinformation ecosystem:
official communications,
state-funded media,
proxy sources,
weaponised social media,
cyber-enabled disinformation.
These channels reinforce one another, allowing narratives to circulate across platforms and audiences.
In practice, the system can be understood through three overlapping layers. State-linked media and government channels establish strategic narratives. Intermediaries, including Telegram channels, commentators and local influencers, adapt them to domestic contexts. Coordinated accounts, artificial engagement and comment campaigns amplify their reach.
How Russian influence operations work
One narrative, many routes
A state narrative is localised on Telegram, seeded by local voices and amplified by coordinated accounts. The infrastructure underneath is spread across many kinds of connection.
Operators can switch between these routes, so taking one data centre offline leaves the others running.
Illustrative model, not measured data. Sources: US State Department Global Engagement Center, Pillars of Russia's Disinformation and Propaganda Ecosystem (2020); Repsense analysis.
Much of this requires surprisingly little computing power. Operators can use residential proxies, mobile devices and rented servers located anywhere in the world. These arrangements also help evade detection, as platforms may flag suspicious traffic originating from major data centres.
Even generating thousands of AI-assisted comments need not require sophisticated infrastructure. Carefully coordinated engagement can sometimes help content gain visibility, depending on platform algorithms. A troll farm does not necessarily live in a farm-sized data centre.
None of this diminishes the importance of the Yandex strikes. Disruptions to its infrastructure may affect how information is indexed, discovered and distributed, alongside the broader economic costs. But disrupting the infrastructure through which information is found is not the same as disrupting the actors who manipulate it.
Before celebrating the victory
Ukraine's strikes exposed genuine vulnerabilities in Russia's technological infrastructure. But the supposed collapse of Russian propaganda bots was a different story, built around a misleading interpretation of technical data and amplified by an unverified graphic.
There is an uncomfortable irony here: an unverified claim about online manipulation gained traction through the very platforms it purported to explain. The apparent disappearance of bots became a story in its own right, reinforced by selective observations and the algorithms shaping what users could see.
Understanding influence operations requires examining content, actors and networks, rather than treating every movement in internet traffic as a measure of propaganda.
Our findings in Lithuania point to a less satisfying conclusion: pro-Russian content did not fall silent. High-risk activity increased, and the narratives continued circulating. Disrupting Russia's digital infrastructure is a significant achievement. Disrupting its influence operations is a different challenge altogether.
Methodological note
Repsense analysed social media activity in Lithuania between October 1 and 11, 2026, across seven platforms: Facebook, Telegram, YouTube, TikTok, Reddit, Instagram and Discord.
Our narrative intelligence platform processes approximately 16,000–18,000 posts and comments daily, assigning each a pro-Russian risk score from 1 to 10. Content scoring 7–10 was classified as high-risk. We examined changes in the volume and intensity of this content before and during the reported Yandex disruptions.
The analysis measures pro-Russian risk signals, not verified bot activity or the number of Kremlin-controlled accounts. It cannot establish whether individual bot networks were disrupted or attribute changes in content activity to the strikes. Findings are limited to the monitored Lithuanian information environment.
Explore how Repsense maps the information environment.
