Pro-Russian accounts targeting Ukrainians on Facebook and Telegram sharply declined after Ukrainian drone strikes on Yandex data centers, according to a new report from a Ukrainian government agency. It’s the most direct evidence so far behind a claim that went viral last week, but it falls well short of proving it.
The report comes from Ukraine’s Center for Countering Disinformation (CCD), which operates under the country’s National Security and Defense Council. It was published Oct. 15, and United24 Media covered it on Oct. 17. The CCD used software from the Ukrainian security firm Osavul to track accounts it flagged as showing "signs of inauthentic behavior." According to Osavul's website, the firm "builds AI-powered risk intelligence for hybrid threats."
According to United24, the CCD analyzed 22,664 messages from 5,201 accounts posted between Oct. 6 and 12, across 26 topics in Ukraine’s information space. The report found two sharp drops in activity, each following a strike that fully shut down a Yandex facility. On Oct. 8, the day a fire took Yandex’s data center in Sasovo, in Russia’s Ryazan region, offline, messages fell 83.6 percent, from 4,032 to 660.
The number of active accounts fell by a similar share. Activity rebounded past pre-strike levels by Oct. 10, but on Oct. 12, a day after a strike fully halted operations at a Yandex data center in Vladimir, messages fell by 42.6 percent and active accounts dropped by 41 percent.
A smaller group of 98 accounts that posted pro-war propaganda, conspiracy theories, or calls for violence followed the same pattern. The CCD concluded that strikes on data centers can significantly disrupt Russian influence networks, but the effect appears to be short-lived.
Mashable was unable to verify the CCD’s findings independently. Before publication, we emailed Osavul to request the underlying dataset, the criteria it uses to flag inauthentic behavior, and any information about where the accounts were hosted. Osavul did not respond by publication time.
The report never defines "inauthentic behavior." While the term is quite broad, some general signals that researchers typically attribute to bot accounts include newly created profiles, unusually high posting volume, blank or AI-generated profile photos, and activity across many unrelated political narratives. Without Osavul’s criteria, it’s unclear whether these accounts are automated, run by coordinated humans, or a mix of both.
Still, if the numbers hold up, they point to something real. The CCD argues that the drops show strikes on data centers can significantly constrain Russia’s information operations by disrupting the automated networks behind them. However, the agency also acknowledges how quickly the accounts came back, suggesting the disruptions were "substantial but short-lived."
Why it matters
The findings arrive after a week of overheated claims.
Last week, Mashable looked at viral claims that Ukrainian drone strikes on Yandex data centers had knocked Russia’s bot army offline. The conclusion we and other outlets reached was that the data behind those claims couldn’t support them.
That claim spread like wildfire on social media, amplified by European officials and even backed up by Ukrainian President Volodymyr Zelenskyy. Speaking at the Warsaw Security Forum, President Zelenskyy said "everyone noticed" a drop in Russian bot activity. Social media users echoed similar observations about the seemingly stark decline in pro-GOP and pro-AfD posts after the strikes.
It was an easy idea to believe, given how platforms like Facebook and X incentivize and reward polarizing political ragebait, and Russia’s online influence operations are well-documented. The claim also seemed to have supporting data. United24 Media, the Ukrainian government-run outlet whose reporting drove much of the conversation, cited an analysis by The Deep Dive of Cloudflare Radar data. That data showed automated traffic from Yandex’s network had nearly vanished by Oct. 11.
As Mashable reported at the time, that data couldn’t support the claim. "Automated traffic" means any request that software, rather than a person, sends to a website, and most of it is mundane. Yandex, often called "Russia's Google," runs the Federation's biggest search engine, so its network constantly sends out crawlers to index the web. Knocking its data centers offline would stop that traffic, whether or not a single troll account went quiet. We found no published evidence tying influence campaigns on social media to Yandex servers, and United24 acknowledged the same limitation.
Cloudflare has since published its own analysis. It said its data doesn’t appear to support claims that the strikes crippled social media manipulation, though it couldn’t rule out a connection. Zelenskyy’s office has also narrowed his remarks. According to BBC Verify, his office said the president was "talking about the atmosphere on social media" rather than a fall in bot activity.