Russian bot traffic dropped dramatically following Ukrainian strikes on Yandex data centers, raising speculation over whether the outages will hurt Moscow’s reported disinformation efforts ahead of the U.S. midterms.
Ukrainian drones have hit three sites belonging to Russia’s leading technology company, whose search engine is the country’s closest variant of Google.
Cybersecurity company Cloudflare reported that bot traffic from the Yandex network temporarily dropped to less than 1 percent of the maximum number of HTTP requests recorded in the past two weeks.
This has prompted questions over whether the Ukrainian strikes could also paralyze Russian disinformation campaigns.
U.S. intelligence agencies are monitoring schemes by Moscow and other adversaries to meddle in the midterm elections on November 3.
Technology commentators have rejected the prospect that hitting the Yandex sites could also erode Russia’s election interference.
However, Carlos Perez, director of security intelligence for cybersecurity consultancy TrustedSec, told Newsweek that disruptions to Russian data centers could potentially affect a much wider range of malicious activity directed by Moscow.
Newsweek has contacted Yandex for comment and is awaiting a response.
...
Which Yandex Centers Were Hit Inside Russia?
Ukraine’s three attacks on Yandex facilities are in retaliation for Moscow’s attacks on data centers inside Ukraine last month that caused significant internet disruption in Kyiv.
On October 8, Yandex’s largest data center in the town of Sasovo, in Russia’s Ryazan region south-east of Moscow, was struck.
Yandex said the damage was serious enough that it could not confirm whether damaged equipment could be restored at the site, which contained tens of thousands of servers.
The site also contained two of its three supercomputers, Lyapunov and Chervonenkis, which are used to develop and train Yandex’s AI model.
Ukrainian President Volodymyr Zelensky said that Russia has been "and still are striking our data centers." referring to attacks in September. He added, "we always respond in kind."
The next day, there was a strike on a Yandex site in Kaluga City which knocked several data center modules with video showing the drone approaching the facility southwest of Moscow.
After the latest strike on Sunday, operations at the Yandex data center in Vladimir, 125 miles east of Moscow, were closed. It caused significant internet service disruptions for businesses, consumers, and critical infrastructure in Russia.
Replacing damaged equipment will take at least six months and would require foreign channels as much of it is not Russian-made, Russian newspaper Kommersant reported.
Getting the centers back to pre-strike capabilities will be expensive and potentially slow to obtain due to the current global shortage of GPUs and memory chips, the newspaper added.
Have the Strikes Impacted Russian Disinformation?
After Sunday’s attack on the Yandex site in Vladimir, global internet monitoring firm NetBlocks said Yandex’s network traffic has dropped to just 30 percent for Yandex Cloud and 63 percent for Yandex LLC.
Cloudflare reported that bot traffic on Sunday had dropped to 0.4 percent of the maximum number of HTTP requests over the last two weeks. However, as of Monday afternoon, that had gone back to 17.3 percent.
This raised questions over whether Ukrainian strikes were also hurting Russia’s disinformation machine.
U.S. intelligence agencies have assessed that Russia will again use digital disinformation to sow distrust in the 2026 midterm results and cause divisions in society, The Washington Post reported last week, citing lawmakers and other officials.
Political journalist Jamie Dupree posted on X: "Ukraine hits another Yandex data center in Russia and Cloudflare data shows Russian bot traffic dropping dramatically. Might have an impact right before the November elections."
"Russian data centers get hit, and online activity around AfD suddenly plummets," said Tomáš Zdechovský, member of the European Parliament on X. He was referring to the far-right German party that has links with the Kremlin.
The historian Timothy Snyder, who writes about the Ukraine War, posted on X, "a lot of pro-Trump and pro-AfD bot work depends directly on Russian data centers."
However, Hadi Ghanbari, a Russian cyber warfare expert, told Newsweek, while Cloudflare data shows traffic from Yandex’s network had collapsed, it is difficult to say if disinformation campaigns run through social media bots or fake accounts were disrupted.
In Cloudflare’s terms, a bot is any automated web request coming from a software program, not a fake social media account, Ghanbari noted.
...
Yandex runs Russia’s biggest search engine, so most of its automated traffic comes from its crawler, which reads webpages to build search results. An outage in Yandex’s infrastructure meant the automated requests sent by this "bot" went down too.
"So, I would say a Yandex outage is unlikely to affect their propaganda infrastructure too much," said Ghanbari, assistant professor of information systems at Aalto University School of Business, in Finland.
Ghanbari said that actors behind coordinated disinformation campaigns usually disguise their accounts by routing them through internet connections in other countries, for example, using commercial proxies or foreign servers.
"Also threat actors and disinformation campaigns rely on crowdsourcing to spread their propaganda through a distributed network of users, who can post from anywhere around the world.
Perez from TrustedSec said that, even if automated traffic from Russian infrastructure is different from coordinated disinformation activity, there is a broader cybersecurity implication due to Russian cybercriminal organizations working with intelligence services.
"As a result, disruptions to Russian data center infrastructure could potentially affect a much wider range of malicious activity, including ransomware operations, cybercrime and influence campaigns," he said.
"With the midterm elections approaching, the question is whether these disruptions will affect the infrastructure supporting malicious cyber operations or simply force those operations to shift elsewhere," Perez said.
A sharp drop in Russian bot traffic may indicate that the strikes disrupted some of the infrastructure used by automated operations, said Jason Vest, a former U.S Homeland Security digital forensic analyst.
"This could affect the reach and coordination of disinfo campaigns in the short term, but it doesn’t necessarily mean Russia’s broader cyber capabilities have diminished," he told Newsweek.
This means that as the U.S. heads into the midterms, defenders should not interpret lower bot traffic as a lasting reduction in the threat.
This is because Russian operators can rebuild or relocate infrastructure, and influence campaigns can continue through compromised accounts, human operators and other channels.
"Lower bot traffic alone doesn’t tell us whether phishing, account compromises or efforts to target election-related systems have declined," said Vest, who is chief technology officer at Binary Defense.
"The key question is whether the drop persists, or activity reappears elsewhere," he added.
"Over the longer term, Russian operators are likely to restore capacity and adapt their tactics, potentially making some operations harder to detect."
How Have Russian Consumers Been Affected?
Russian banks, retailers, mobile operators, transport services, and major news sites experienced outages and cloud services, payments, deliveries, and other online services across the country were disrupted.
Consumer transactions in Russia have been affected. Users of Yandex Pay digital wallet and payment service have found they are unable to withdraw funds with their bank cards, opposition news outlet Verstka reported.
Some Yandex features, such as its disk cloud storage, have been reduced. The firm has reached a deal with other Russian cloud providers VK Cloud, Selectel, and K2Cloud to host customer data and services.
"When you hit a single point of failure like Yandex that provides services to thousands of businesses in a network or supply chain, you can cause outages throughout the network and damage to the whole supply chain," said Ghanbari.
Are Data Centers the New Front in the Ukraine War?
Russia and Ukraine are now targeting each other’s data centers, opening a new front in the war that has been raging for more than four and a half years.
"This has security implications far beyond Russia and Ukraine: physical protection of data centers becomes a much bigger concern, and resilience and geographic diversification of data move from best practice to necessity," said Vest.
Ghanbari said that Ukraine seems to have prepared for this situation; its critical state data has reportedly been stored in foreign data centers since 2022, the year the full-scale invasion started.
"If this situation escalates, foreign cloud services and data centers that host Ukrainian data could become logical targets for Russian cyberattacks or even sabotage," he added.
But, as attacks increase, many organizations are being rushed into emergency migrations to other data centers or cloud services.
Because cybersecurity is a meticulous process, such emergency work increases the risk of security misconfigurations, weakened access controls, and unpatched backup systems.
"All these vulnerabilities can be exploited by opportunistic attackers to cause more damage," Ghanbari added.
Contact Newsweek editors on this story: Ben Kelly and James Debens