Abstract:
After Ukraine launched a recent drone attack on a data center operated by the Russian technology company Yandex, a striking statement emerged on social media: Russian government-backed trolls and disinformation campaigns appear to have suddenly declined. Ukrainian President Zelensky also publicly spoke about this phenomenon, saying that hate speech, divisive content and provocative behavior have decreased on multiple social platforms.
However, further investigation revealed that this statement lacked reliable evidence to support it, and the relevant data was likely to be misinterpreted. Drone attacks did cause damage to some of Russia's digital infrastructure, but this does not mean that Russia's disinformation network was severely damaged.
According to reports, Ukraine successively attacked multiple data centers operated by Yandex in Russia in early October 2026. Yandex is one of the most important Internet technology companies in Russia. Its business scope covers search engines, online ride-hailing, food delivery, cloud computing, artificial intelligence and other digital services. It occupies an important position in Russia's Internet infrastructure.
The attack caused actual infrastructure damage. On the night of October 7th and 8th, the data center in Sasovo, Ryazan Region, was attacked by drones. The facilities were severely damaged and forced to shut down completely. Subsequently, the data center in Kaluga Region was also attacked, and some infrastructure could not continue to operate. Since then, data centers in the Vladimir region have been hit again, and related facilities have stopped operating, causing some network services that rely on these infrastructures to malfunction.
Yandex later confirmed that some data centers had been attacked and said that the company was assessing the damage and working hard to restore services. Since data centers carry a large number of servers and computing resources, their operating status not only affects the Internet products used by ordinary consumers, but also affects the business of enterprises that rely on cloud computing platforms.
After the attack, some social media users began to claim that there was a significant decrease in the activity of bot accounts originating from Russia. They said that the posting and interaction frequency of some political accounts has decreased, the content dissemination of accounts related to some far-right political groups seems to be less active, and users have reported that they have received fewer spam calls and harassing messages.
Ukrainian President Zelensky later also talked about this phenomenon. At the Warsaw Security Forum held on October 12, he said that after Ukraine took action against Russian data centers, the online environment on some social media platforms seemed to have improved, with a reduction in hate speech, social divisions and provocative content. He used this to question whether Russia has long used automated accounts to influence online public opinion in Europe and other regions.
These claims quickly sparked discussion. If Russia indeed uses relevant digital infrastructure to organize large-scale cybermilitary activities, then whether attacks on data centers can directly weaken its ability to spread transnational disinformation becomes a matter of concern.
The problem, however, is that the key data supporting this claim do not prove that there has actually been a significant decline in troll activity.
An important source of controversy is data released by Internet infrastructure company Cloudflare. After the attack, Cloudflare Radar showed a significant drop in automated traffic from the Yandex network. Some Internet users interpreted this change as a sharp decline in Russian bot account activity, and further believed that the Yandex data center may have provided important infrastructure for Russian government-backed disinformation operations.
However, anti-disinformation monitoring account antibot4navalny pointed out that this interpretation confuses two types of automated traffic with completely different natures.
The relevant data collected by Cloudflare mainly involves automated requests from the Yandex network, including web crawlers used by search engines. Such programs automatically visit websites, read web content, and index the information so that users can find relevant pages through search engines. They may also undertake other automated tasks, but just because it is bot traffic, it should not be considered political trolls on social media.
In other words, the sudden drop in automated visits from the Yandex network first shows that some of Yandex's own network infrastructure or related services have been affected. It does not directly prove that Russian accounts used to spread political propaganda and disinformation have stopped simultaneously.
This distinction is important. Although web crawlers and social media trolls may both be collectively referred to as robots, there are significant differences in how they operate, their purpose of use, and their infrastructure requirements. Search engine crawlers often need to continuously visit a large number of websites, while social media trolls can operate through a large number of dispersed accounts, proxy servers, and network connections in different countries. The destruction of servers in a company's data center does not necessarily lead to a large-scale shutdown of the latter.
Other analysts have also questioned the so-called sudden drop in Russian cyber troll activity.
According to the "Kyiv Independent" report, cyber threat intelligence expert Roman Osadchuk pointed out that there is no reliable way to integrate bot accounts and online troll activities on different platforms into an accurate and comprehensive statistical result in the absence of internal data from each social media platform. Even if there is a decrease in posts and interactions on social media, further analysis will be needed to determine whether it is the result of a decline in automated accounts, changes in real user activity, or other technical factors.
Some observers did note a drop in engagement on some social media accounts after the attacks. But this is not enough to establish causation. Differences in activity between weekends and weekdays, technical issues with network services, work schedules of different operations teams, and changes in general user behavior can all cause similar phenomena.
Meanwhile, Russian-backed disinformation networks show no signs of fully ceasing their activity. Antibot4navalny still reported multiple pro-Kremlin accounts posting videos and spreading false narratives on the same day that Zelensky made the relevant remarks. These include claims that experts have asked the EU to lift sanctions on Russia.
This shows that even if some Yandex data centers are destroyed, Russian-related political propaganda accounts can still continue to publish content. The available evidence is insufficient to prove that these attacks dealt a decisive blow to Russia’s ability to spread disinformation.
Another issue worth noting is that Russian cyber influence operations themselves may be highly decentralized.
The spread of false information does not necessarily need to rely on the data center of a certain technology company in Russia. Relevant actions can be carried out through overseas servers, agency networks, commercial social media marketing services, and accounts distributed in different countries. Some cyber influence operations may even rely on outsourcing teams or network infrastructure in places such as North Macedonia and the Philippines, thereby reducing reliance on servers in Russia.
This decentralized architecture makes it possible for the entire network to continue operating even if a single infrastructure is hit. Even if some servers are temporarily unavailable, operators may resume activity through other network nodes, accounts and services.
In addition, commercial account interaction services also make the problem more complicated. Some accounts may purchase likes, comments, and retweets to expand the reach of content, but the networks that provide these services are not necessarily directly affiliated with a country or political organization. Therefore, it is difficult to accurately determine the extent of the impact of a state-sponsored disinformation campaign based solely on changes in social media interaction volume.
Poland and other European countries have also reported a decrease in Russian robot activity, but relevant agencies have not yet released complete data sufficient to confirm this conclusion. The Disinformation Analysis Center, part of the Polish National Research and Academic Computer Network, said it found no evidence of a significant decline in the activity of disinformation accounts during the relevant time period it monitored. What the center observed was that individual accounts ceased activity, and there is no basis to clearly attribute these changes to the Ukrainian attack on the Yandex data center.
For cybersecurity researchers, such incidents also expose another problem: how easy it is for the public to interpret changes in technical indicators directly as changes in political influence operations.
When a certain statistic suddenly fluctuates significantly, people tend to look for an intuitive reason. If the fluctuation happens to occur after a military attack, it is easier to link the two. However, what exactly is measured in the data itself, what objects are included in the statistical scope, and what is the relationship between relevant indicators and actual political activities all need to be rigorously verified.
In this incident, the decrease in automated requests from the Yandex network and the decrease in Russian cyber trolls are actually two different issues. The former can be observed through Internet traffic data, while the latter requires a comprehensive analysis of account behavior, content dissemination patterns, network connection sources and the operation methods of relevant organizations on multiple social media platforms.
This does not mean that attacks on data centers will not impact Russian cyber influence operations. If the operation does use damaged facilities, the attack may cause some degree of disruption. However, so far, the public evidence is not enough to prove that the Yandex data center is the core operation hub of the Russian cyber trolls, nor can it be confirmed that these attacks have caused a large-scale and sustained decline in Russian disinformation activities.
Meanwhile, the damage to digital infrastructure caused by the attacks remains very real. The Yandex data center hosts a large number of services for ordinary users and enterprises. The outage of the facilities may affect online ride-hailing, food delivery, payment, cloud computing and other daily businesses. These direct impacts are easier to verify through service outages and corporate announcements than political campaigns on social media.
From a broader perspective, the Russia-Ukraine conflict is further extending to the fields of data centers and Internet infrastructure. Russia has previously launched attacks on Ukraine’s digital infrastructure and communications facilities, and Ukraine has also begun to attack facilities in Russia that perform important computing and network service functions. Data centers are therefore becoming a new and important target in this conflict.
The impact of this type of attack depends not only on the size of the facility itself, but also on the services it handles, how centralized the network architecture is, and whether services can be quickly moved to other locations. For a digital economy that relies on a few large data centers to operate, the centralization of infrastructure can improve computing efficiency, but it may also amplify the chain reaction caused by a single point of failure.
Therefore, there is still no conclusive answer to the extent to which the Ukrainian attack on Yandex data centers weakened Russia's cyber influence operations. What can be confirmed is that some automated network traffic and digital services were affected after the relevant facilities were destroyed. However, there is no sufficient basis to directly interpret these changes as a heavy hit to the Russian cyber trolls.
This controversy also reminds people that in an environment where information warfare and military operations are intertwined, data may not only be used to describe reality, but may also be misinterpreted, or even packaged as evidence that a certain operation has been successful. If you regard unverified results as established facts, it may obscure the real source of threats and derail subsequent network security and anti-disinformation work from the focus.
Comments