Experts debunk Zelensky's claim that Yandex strikes silenced Russian bots

Key points

• Ukraine struck three Yandex data centers between October 8 and 11, causing widespread outages for services like Yandex Go and Yandex Pay.
• Zelensky claimed the strikes reduced online hate and bot activity, but BBC Verify and independent researchers found no evidence of a drop in known Russian influence operations.
• The perceived drop in bot activity stems from misinterpreted Cloudflare data, which measures all automated web requests, including search engine crawlers, not just social media bots.
• Yandex has entered emergency mode, running out of spare capacity, and advised customers to migrate data to competitors like Selectel and VK Cloud.
• Full recovery is expected to take months as hardware delivery times are currently up to six months, and Russian law restricts storing data outside the country.

Background

These strikes follow a pattern of reciprocal attacks on critical infrastructure. In late September and early October, Russia targeted Ukrainian data centers and energy infrastructure, which Kyiv described as a 'mandatory digital detox.' The current strikes on Yandex are part of a broader escalation in the conflict, occurring alongside disputes over an 'energy ceasefire' proposed by US President Donald Trump and reciprocal truce offers from Zelensky. Previous archive coverage highlights the intensifying winter strike campaign and civilian casualties in cities like Kramatorsk and Zaporizhzhia, setting the stage for these retaliatory cyber-physical attacks.

How outlets are covering it

BBC Verify and independent researchers like dTeam and Mikhail Klimarev argue that the claim of reduced bot activity is a misinterpretation of data. They note that Cloudflare metrics show a drop in automated traffic because Yandex shut down its web crawlers to conserve resources, not because social media bots were disabled. In contrast, social media users and some politicians, such as Czech MEP Tomáš Zdechovský, initially interpreted this data as proof that Russian influence operations targeting groups like the AfD and MAGA movement had collapsed. Mashable highlights that while the strikes disrupted Yandex's infrastructure, there is no published evidence linking specific Russian propaganda accounts to Yandex's servers. Meduza emphasizes the broader economic impact, noting that the strikes have paralyzed Russia's digital economy and exposed the vulnerability of centralized data storage, with recovery potentially taking months due to hardware shortages and legal restrictions on offshore data storage.

Why it matters

The incident highlights the growing intersection of physical warfare and digital infrastructure. While the strikes did not eliminate Russian disinformation networks, they demonstrated the fragility of Russia's digital economy, which is heavily dependent on Yandex. The widespread outages affected millions of users and major companies, causing significant economic losses. Furthermore, the debate over the effectiveness of these strikes underscores the challenges in measuring the impact of cyber-physical attacks on influence operations, as traditional metrics like web traffic do not accurately reflect social media bot activity. The long recovery timeline also suggests that Russia's digital infrastructure may remain vulnerable to future attacks, potentially impacting its ability to sustain influence campaigns and essential services.

What to watch

Yandex is likely to continue migrating services to competitors and exploring protective measures for its remaining data centers. The Russian government is expected to work with the Defense Ministry to arrange protection for data centers, potentially including air defenses or underground structures. Full recovery of services may take months, depending on hardware availability. Ukraine may continue targeting Russian infrastructure, while Russia may retaliate against Ukrainian data centers and energy infrastructure. The debate over the effectiveness of these strikes in reducing disinformation will likely continue, with experts calling for more accurate metrics to assess the impact of cyber-physical attacks on influence operations.