The Silence of the Bots: What Happened After Russia’s Biggest Data Centers Were Hit?

Oct 15, 2026 16:22

8 min read

Prefer U24 Media on Google

Authors

Joseph Place

Author

Internet users around the world have noticed a decrease in pro-Russian bots and propagandists’ narratives since October 8.

Between October 8 and 9, Ukraine hit three data centers owned by Yandex, the major Russian technology company that provides services such as the country’s main search engine. There are major impacts on the internet across the country, and some are even noting decreases in pro-Russian bots online. 

Which Yandex data centers did Ukraine strike?

So far, there have been three strikes.

The first hit the Ryazan region—around 500 km from Ukraine—on October 8. The second strike hit Russia’s biggest center in Kaluga—around 430 km away. The third occurred in Vladimir—a whole 687 km from Ukraine’s border. This is yet another example of Ukraine’s deep-strike capabilities.

Inside these data centers were major supercomputers, such as Chervonenkis—Yandex’s most powerful—and Lyapunov. These were likely severely damaged or destroyed and may be beyond repair or rebuilding. 

What impact did these strikes have? 

The Russian military uses Yandex's data processing services for military purposes. As Yandex is entirely Russian-owned after a sale of its foreign shares, it has a close relationship with the Kremlin. This data processing and third-party applications will impact state functionality. 

By striking these data centers, Ukraine severely disrupted internet coverage within Russia. Online services went offline; the third strike disrupted around 80 Yandex Cloud services. Yandex provides a wide range of services, from its search engine and API software to cloud storage and navigation apps. 

“The impact is very serious both for Yandex and Runet,” told us Sergiy Petrenko, the former CEO of Yandex operations in Ukraine, before resigning in 2014 as Russia first invaded Ukraine. “Yandex’s services, such as Search, Maps, Taxi (actually, a whole range of delivery services), Mail, Disk, and Market, are essential for the Russian audience.” 

He noted how the search share of Yandex in Russia is about 70%; Yandex Taxi has a share of 96% in Moscow and 70–90% in big cities; overall audience reach is 85%. 

“It seems that Taxi services have seriously degraded, to say the least. There is also Yandex Pay/Yandex Bank—a fintech company, or neobank, currently in the top 10 retail banks by deposits. Pay is completely offline now; deposits are inaccessible.” 

It goes beyond their own services. Petrenko shared how third-party businesses are also impacted—advertising solutions from Yandex account for approximately one-third of all online advertising in Russia; Yandex Cloud is relatively small (11% of the cloud solutions market) but still serious, and now it is offline. 

Did Russian bots really stop posting? 

The most widely reported impact, however, is on bots. President Zelenskyy said at the Warsaw Security Forum that there was a notable decrease in the number of bots online after the strikes. 

Cloudflare Radar data showed a major decrease in automated traffic originating from Yandex’s AS13238 network following the strikes, with requests approaching zero on October 11.

The graph alone does not give us a full picture on whether bots went down, though it does not prove these strikes made no difference either. These figures do not distinguish who owns the bot requests, as noted by the Deep Dive. Petrenko said that much of the traffic originating from Yandex’s AS13238 network likely came from YandexBot, the company’s search engine crawler.

Traffic from Yandex Cloud’s AS200350 network also declined, although the data does not reveal whether the activity was legitimate or what services were affected. As Petrenko pointed out, traffic originating from a data center would naturally disappear if that facility went offline.

Polish analytical channel Res Futura Data House noted no decrease in bots within Poland, for example. However, the drop in automated requests is still notable, and many have observed drop-offs in bot activity. 

European politicians such as Czech MEP Tomáš Zdechovský and observers have noted how some posts on social media seemingly decreased after the attacks, as have other far-right, anti-EU, and anti-Ukraine political posts. 

David Colon, a French information operations researcher, noted that the Russia-linked information operations group Storm-1516 experienced a significant drop in activity. Impressions dropped from millions to tens of thousands. According to Polymarket, US political subreddits also saw activity decline after the attacks.

Certain phrases went down, and others increased as well, such as “Zelensky” on X. Far-right accounts received a decrease in amplification at the same time, as British politician Roz Savage shared data on such accounts decreasing. 

Prominent pro-Russian voices on social media also saw drops in engagement on X, such as Tucker Carlson, Max Blumenthal, Douglas MacGregor, Scott Ritter, and more. 

Could the strikes have disrupted Russian propaganda bots? Petrenko believes they could, though the extent of the impact depends on which infrastructure those operations rely on.

Russian bot networks may rely on cloud services such as Yandex Cloud, but they also have alternatives, including other Russian providers, Western hosting services, and botnets—networks of compromised computers and mobile devices, he said.

"Strictly speaking, Russian interference can be influenced, even damaged, by such attacks," Petrenko said, adding that "for serious disruptions, these attacks have a lot of room to scale.” 

How did three strikes disrupt so much of Russia’s Internet? 

The scale of the attack is what has made such a major impact, as Petrenko said. 

“Yandex has 5 large data centers in operation and, maybe, 10–15 small points of presence—the latter vary from several racks on Internet Exchanges fabric to small server rooms somewhere.” 

He estimates that the three strikes amount “to more than half of the overall capacity loss—there are no companies that could survive that easily or restore their operations quickly.”

The issue is the dependencies. Some services, even if not directly affected, are still suffering. “The reported loss of three supercomputers results in nonfunctional AI functions across many services, including Alisa, a talkbot for smart devices.”

When asked whether the issue is a centralized approach, he answered that the main principle of redundancy at Yandex since the 2000s has been the following: the main services (Search, Mail, Maps, etc.) should survive the loss of at least 1 data center without a visible effect on the customer. Tier 2 services can slightly degrade without 1 center. 

“But this is about tech incidents, like power or connectivity outages, maintenance, and some internal failures,” he said. “This architecture was not supposed to survive a military attack, when several data centers are not just switched off—servers are likely destroyed, data has been lost, and the optical network is physically melted.” 

There is a concentration geographically. Most of Yandex's (and Russian internet overall) infrastructure is concentrated in the Moscow region and several nearby regions, Petrenko said. 

Petrenko said that no one will build a large data center for all of Russia in Siberia or the Far East due to a lack of infrastructure. “The situation is the same for the rest of the big internet companies—75% of data centers in Russia are located in Moscow and nearby regions.”

Read more

Category

War in Ukraine

Win the Mind, Win the War: How Russia Wages Cognitive Warfare

Jul 07, 2026 16:29

The USA and the EU have applied sanctions and restrictions on the export of information technologies and software to Russia and Belarus. This has led to many shortages that impact Yandex’s ability to operate and respond in case of large-scale emergencies, and similar outcomes could be expected. Earlier in 2026, Ukrainian Foreign Intelligence observed that Russian data centers were nearing their limits, with increased outages, and the inability to access Western parts meant that suboptimal domestic or Chinese analog components for data centers were used. 

Nearly all server hardware in Russia relies on foreign parts, even when assembled locally. However, software is largely custom and open-source, so it should not pose a challenge. But “the scale of the attacks affects recovery—one cannot simply order tens of thousands of servers or kits, particularly given the global shortage of memory, CPU, and GPU,” said Petrenko.

Another aspect is Yandex’s architecture. Active-passive setups—a main site with a backup that assumes control during failure—are typical in corporate IT, yet Yandex’s core services operate active-active— multiple nodes to step in— across multiple data centers, built to withstand losing one site without noticeable disruption. But, according to Petrenko, the issue lies not in the redundant design but in scale. 

He elaborated that active-active systems depend on a majority of sites remaining functional. Losing two or three of five sites causes major disruptions, and the remaining capacity cannot handle the load. “Yandex Cloud clients suffered more because most operated within a single availability zone lacking redundancy” meaning they couldn't rely on other data centers. “After all, sustaining service across even two regions demands extra funds and a different strategy.” Every factor combined has meant that these strikes make a huge difference to Russia’s internet as a whole.

On the Frontline of Truth

Our reporters work on the frontlines to show what’s really happening in Ukraine. Your support helps them keep reporting.

SUPPORT