0.4% — the strikes on Yandex hit Russia's digital economy, but not the propaganda bots: what the data shows

Ukraine has knocked out part of Russia's digital infrastructure, but the viral claim that the strikes silenced pro-Kremlin, pro-Trump and pro-AfD bots rests on a misread chart and is not confirmed by independent measurements.

This analysis separates three things that have been mixed up in recent days: what was hit and with what effect, what the chart that went viral actually measures, and what is known about the bot networks targeting Germany, the United States and Romania. We also added our own measurement, on the data olivLaw collects every day.

The testable thesis: the strikes on Yandex are the most serious blow yet to Russia's digital economy, but not to its influence operations, which run on Western platforms and on hosting outside Yandex. Anyone who wants fewer bots needs data from the platforms, not drones.

What was hit, in order

Date	What happened
late September	Russia attacks data centres and mobile networks in Ukraine; in Kyiv, up to 100,000 households temporarily lose internet and signal
8 October	Drones and a fire at the Yandex data centre in Sasovo, Ryazan region; operations fully halted
9 October	The centre in the Kaluga region: Yandex says "several modules are completely knocked out"
11 October	The centre in Vladimir, 180 km from Moscow, shuts down completely after a drone strike
12 October	Zelensky, at the Warsaw Security Forum: there were "fewer bots" on social media

The context comes from Ars Technica, and the strike dates from Meduza and The Record. The Ukrainian military has not officially claimed the strikes. Zelensky described them as a response to Russian attacks on Ukrainian data centres.

The economic effects are real and measurable. More than 80 Yandex services were affected, from payments and taxis to maps, email and cloud. The problems also reached Belarus, Kazakhstan, Kyrgyzstan, Armenia and Moldova. Yandex moved some of its clients onto other Russian companies' infrastructure and added a force majeure clause for drone attacks to its user agreement, according to Meduza. Replacing the destroyed equipment would take about six months, according to Kommersant.

The claim that went viral

On 12 October in Warsaw, Zelensky said that after the strikes "it suddenly became a little easier to breathe on many social media platforms". "There was less hate, less division, and fewer provocations because there were fewer bots," he added, according to RFE/RL. A day earlier, Czech MEP Tomáš Zdechovský had written on X that, "if confirmed", activity around the AfD "suddenly plummets". Lithuanian Prime Minister Mindaugas Sinkevičius went further, saying allies should ask Zelensky to strike more data centres to protect elections, according to European Pravda.

In the Romanian press, the claim reached headlines as fact: pro-Trump and pro-AfD bots had been "silenced" or had "collapsed". The source was a chart shared by the NEXTA Telegram channel and by foreign outlets, to which some users added party logos. A few newsrooms, including HotNews and Libertatea, asked whether it was true.

What the chart actually measures

The chart comes from Cloudflare Radar and shows automated traffic leaving Yandex's network, autonomous system number AS13238, towards websites protected by Cloudflare. On the night of 11 October, this traffic fell to about 0.4% of its recent peak. But almost all of that traffic is generated by YandexBot, the robot that reads web pages for the Yandex search engine. The chart cannot see what happens on X, TikTok, Facebook or Telegram.

The operator of the @antibot4navalny account, one of the researchers who have tracked Russian troll networks for years, told RFE/RL that the chart "has little to do with malicious propaganda bots on social media". "It measures automated requests to websites (of any kind, among which social media share is negligible)," they explained.

An analysis of the Cloudflare data published by Brendon Beebe shows the same thing from another direction. YandexBot accounted for about 99.8% of Russia's "verified bot" requests, before and after the strikes. Automated traffic from the Rostelecom, MTS and Beeline networks did not fall. Across Russia as a whole, automated traffic went from 86% to 83% of its monthly peak. Had bot farms been hit, the drop should have shown up there too.

What independent measurements show

The few monitors that track posts directly saw no collapse. CAT-UA, a Ukrainian monitor following about 10,000 mentions a day, found no significant drop, according to the analysis cited above. The big pro-Kremlin Telegram channels kept posting at their usual pace. Counts of German-language posts on X over the weekend of 10–11 October show drops for every party, not just the AfD: AfD −19.3%, CDU −17.8%, SPD −36.8%, Greens −28.6%. That suggests a quiet Sunday rather than a network switched off, and these figures were obtained through Grok and cannot be independently reproduced.

The only documented sign of disruption concerns the "Pravda" network, which automatically produces millions of articles a year. An anonymous tracker observed that it lost about half its output for roughly 13 hours after the Vladimir strike, then recovered. That looks like a system automatically shifting its traffic to other servers, not a destroyed network. The tracker's methodology has not been independently audited.

What olivLaw's data shows

We checked our own data for 20 September – 12 October: the daily posts of two pro-Kremlin Telegram channels we monitor, and the groups of near-identical articles published by different sources within a short window, which our coordination detector flags as suspect. We compared the 18 days before the first strike with the five days after it, using a permutation test.

Signal	Before (20.09–7.10)	After (8.10–12.10)	Difference	Significance
Intel Slava Z (Telegram, pro-Kremlin)	36.3 posts/day	43.8 posts/day	+21%	not significant (p = 0.09)
Rybar (Telegram, pro-Kremlin)	18.1 posts/day	15.4 posts/day	−15%	borderline (p = 0.04)
Groups of posts suspected of coordination	3.1/day	3.4/day	+9%	not significant (p = 0.80)

Only Rybar declined, but it has a simpler explanation than the strikes: the channel's founder, Mikhail Zvinchuk, was detained and expelled from Montenegro on 9 October as a threat to national security, according to Digi24. The other channel posted more, not less, and the number of groups suspected of coordination did not change. Our data does not cover X or TikTok, so it cannot rule out every effect. But it can say that the signals we measure show no collapse.

Where influence networks actually live

No public report links the main Russian influence operations to Yandex's servers. The Doppelgänger network, which clones Western media websites, used servers in Frankfurt and Moscow through the St Petersburg firm Aeza, and its infrastructure was spread across European companies, according to The Record. The Storm-1516 operation, which produced the fake videos in the German election campaign of February 2025, used hosting in the United States, often behind Cloudflare, according to the French agency VIGINUM. The "Pravda" network is run by a company in Crimea, according to DFRLab.

There is also a technical reason. A fake account on X does not "live" on a Yandex server: its posts sit on X's servers, and its operators control it through proxies and phones or computers anywhere. For a strike on a data centre to stop such a network, the network would have to run its automation exactly there, with no backup. The known networks are built precisely to survive takedowns, with backup accounts and domains.

Pro-Trump and pro-AfD bots: what is documented

That Russia uses inauthentic networks in Western election campaigns is well documented. Before the German election of February 2025, German security services attributed to the Storm-1516 operation fake videos, for example about AfD ballots "destroyed" in Leipzig, which drew hundreds of thousands of views on X, according to The Record. They mostly attacked the electoral process and other parties rather than directly promoting the AfD.

There is, however, no public, measured series of pro-AfD or pro-Trump bot activity in 2025–2026 against which a drop after 8 October could be shown. The viral claim compares a chart about crawlers with an impression of the mood on X. That matters above all for the United States, which votes on 3 November in the midterm elections, and for Germany. A false belief that "the bots have been switched off" can lower vigilance just before elections.

Romania: where the real risk lies

For Romania, the lesson of 2024 is that online influence did not depend on a data centre. The documents declassified by the Supreme Council of National Defence in December 2024 described more than 25,000 TikTok accounts activated about two weeks before the vote to promote Călin Georgescu, according to RFE/RL. In April 2025, TikTok removed a network of 4,453 accounts operating from Turkey and mainly promoting AUR, according to the platform. The platform did not attribute it to Russia.

The thread continues in 2026. On 9 October, the influencer Bogdan Peșchir was sent to trial for voter bribery, accused of financing the promotion of Georgescu on TikTok with almost 300,000 dollars, according to Agerpres, and the European Commission's investigation into TikTok is ongoing. On 12 October, a fake AI-generated video in which Putin "speaks Romanian" was circulating virally on TikTok, according to G4Media. None of these mechanisms (money for influencers, coordinated accounts, AI-generated content) depends on Yandex. We found no data showing a change in Romanian networks after the strikes.

The causal chain and the counter-hypothesis

The cause. The strikes hit the civilian and commercial infrastructure of Russia's largest technology company. The mechanism of the viral claim assumes that bots ran on that infrastructure. The effect actually measured is a collapse in Yandex crawler traffic, not in social media posts. The missing link is evidence that influence operations used Yandex Cloud, and it exists in no public source.

The counter-hypothesis. Indirect effects may exist that we cannot yet see. Some Russian operations could use Yandex services, for instance language models to generate texts, email services to create accounts or cloud for automation, and disrupting them would slow output without stopping it. The 13-hour disruption of the "Pravda" network is consistent with this hypothesis. It remains open: we will consider it confirmed only if a recognised research centre publishes a measured series showing it.

What should be done

Claims about bots can only be verified with data from the platforms, and the EU's Digital Services Act obliges large platforms to give researchers access to such data. In Romania, the authorities should use this right before the next elections, and newsrooms should treat viral charts like any other source, with the question "what does it actually measure?".

For the general public, the rule is simple: a chart of "bot traffic" is not the same thing as the activity of fake accounts on a social network. And a calmer mood on X over a weekend can have many explanations before a military one.

Update, 13 October: did reported dangerous links drop?

After publication, we also checked another claim that was circulating: that spam and dangerous links fell after the strikes. We counted, day by day, the malware-distribution links reported in the public URLhaus database and the new command servers of botnets and malicious programs in ThreatFox, both run by abuse.ch. Each IP address was located by country and network using the public iptoasn.com database. We compared the 24 days before the strikes (14 September – 7 October) with the five days after.

Series (daily median)	Before	After	Conclusion
URLhaus, all links	607	540	−11%, not significant
URLhaus, links hosted in Russia	9	5	drop explained by a reporter that stopped submitting
ThreatFox, new command servers	228	272	+20%, not significant
ThreatFox, command servers in Russia	3.5	1.0	not significant (p = 0.21), again from reporting
Links or servers on Yandex networks	0	0	none in 30 days

The result confirms the conclusion above. Overall, dangerous links and command servers did not fall. The small drop in those hosted in Russia comes from the fact that two reporters who submitted them often, the Czech CERT in URLhaus and the company Deepfield in ThreatFox, almost stopped reporting after 8 October. Without the Czech CERT, Russian links go from 7.8 to 5.6 a day, a difference that is not statistically significant (p = 0.30). Yandex networks hosted no reported link or server in the past 30 days, so these databases cannot show any effect of the strikes.

Update, 13 October: did the volume of posts about the AfD, Trump or the Kremlin drop?

The second question worth checking was the one we started from: if the bots went quiet, the volume of posts on the topics they push should fall. We counted, day by day, on Bluesky, the only large network that allows a public search of past posts, how many posts mention the AfD (AfD, Alice Weidel, Höcke), MAGA (MAGA, Trump) and the favourite themes of Russian propaganda in English (Zelensky, Ukraine aid, NATO). Each group has a control group in the same language (CDU, SPD, the Greens and Merz for German; Democrats, Congress and the Supreme Court for English), so a drop counts only if the control does not drop as well. The window is the same as above: 14 September – 7 October, against 8–12 October.

Group (daily median)	Before	After	Ratio to control, before → after	Conclusion
AfD, in German	1,499	1,635	0.48 → 0.49	no change
MAGA and Trump, in English	53,072	60,109	4.22 → 5.72	at the top of the usual range (2.83–5.95), so a slight rise, not a drop
Zelensky, Ukraine aid, NATO, in English	1,262	3,730	0.10 → 0.33	a rise, from 10 October, along with the news about the strikes
Georgescu, Simion, Șoșoacă, AUR, SOS România, in Romanian	4	3	—	too few posts to matter

Here too, the silence announced by the viral chart does not appear. Posts about the AfD stayed in exactly their usual proportion to the other German parties, those about Trump rose slightly, and the themes linked to Ukraine and NATO tripled, which is explained by the strikes being news themselves.

The measurement has limits that we state plainly. It counts mentions, made by anyone, including critics of these parties, not only favourable posts or those from fake accounts. Bluesky's audience leans left, and the networks where Russian campaigns usually operate, X, TikTok and Telegram, do not allow such a count. In Romanian, the volume on Bluesky is too small to say anything. olivLaw now collects these series daily, with a classification of each post's stance that will be checked against a sample labelled by people before we publish any figure from it.

Two limits remain. Five days is a short period, and the reported count also measures how active the reporters are, not just the attackers. We could not also check email phishing, because the public PhishStats database was unavailable. We will repeat the check once several more weeks of data have accumulated.

Testable predictions

Prediction	Horizon	Probability	How it is checked	Verification source
A recognised research centre (DFRLab, ISD, CheckFirst, Alliance4Europe, NewsGuard or VIGINUM) publishes a measurement attributing to the Yandex strikes a significant and lasting drop in a Russian influence operation on social media	by 31.12.2026	10–20%	A public report with a data series before and after the strikes	dfrlab.org, isdglobal.org, checkfirst.network, newsguardtech.com, sgdsn.gouv.fr
Ukraine hits at least one more data centre of a large Russian company	by 30.11.2026	60–75%	Confirmation by the company or by Russian authorities	Interfax, Kommersant, The Record
Russia again hits data centres or telecom networks in Ukraine	by 30.11.2026	75–90%	Confirmation by Ukrainian operators or authorities	Ukraine's Ministry of Digital Transformation, mobile operators
The European Commission adopts a non-compliance decision or a fine against TikTok in the Romanian election case	by 30.06.2027	20–35%	The Commission's published decision	ec.europa.eu (DSA)
Yandex announces that all services affected by the strikes are fully working again	by 30.11.2026	50–65%	The company's statement	yandex.ru, Interfax

Method, definitions and figures

olivLaw's data. The posts of the Intel Slava Z and Rybar Telegram channels are those collected daily by olivLaw. The groups suspected of coordination are those flagged by our detector: near-identical articles published by different sources within a short window. We excluded legitimate syndication, meaning the same agency text carried by several newsrooms. For each series we compared the daily average for 20 September – 7 October with that for 8–12 October, using 20,000 random permutations of the days.

Terms. A "crawler" is an automated program that visits websites to index them for a search engine. A "propaganda bot" is an automated or semi-automated social media account that publishes or amplifies messages. The two are often lumped together under the same word, "bots". Probabilities are editorial estimates in bands of at least ten percentage points.

Limits of this analysis

This analysis is written five days after the first strike, too early for the major research centres' reports. Our data does not cover X, TikTok or Facebook, and the post-strike period is only five days long. Several sources cited are secondary: the Beebe analysis, the anonymous tracker, the counts obtained through Grok. We found no data on Romanian networks after the strikes.

The diagnosis would be refuted by a measured series, published by a credible research centre, showing a lasting drop in the activity of a known Russian operation, linked to Yandex infrastructure. The natural reassessment comes with the first quarterly reports from the platforms and researchers.