Russian bot activity plunged 84% after Ukraine hit Yandex data centers, but the bots were back at full strength within two days
When Ukrainian drones crippled Yandex’s Sasovo and Vladimir data centers, the immediate fallout was a dramatic plunge in suspected Russian bot output, yet within two days the same networks resurfaced at full strength, exposing the limits of kinetic disruption in modern information warfare.
Immediate Collapse of Bot Traffic After the Sasovo Strike
The Center for Countering Disinformation (CCD) recorded an 83.6% drop in bot‑generated messages on October 8, the day a drone strike ignited a fire that shut down Yandex’s Sasovo facility, home to two of its three supercomputers. Daily message volume fell from 4,032 to 660, and the pool of active accounts shrank from 1,526 to 258.
Platform‑specific impacts were stark: Telegram output plunged 90%, while Facebook activity declined by 79.5%. The rapid contraction suggests that a sizable share of the malicious automation relied directly on Yandex’s cloud resources.
These figures come from Osavul monitoring software, which tracked 22,664 messages across 5,201 accounts between October 6 and 12, confirming that the outage was not a statistical anomaly but a real, observable shock to the bot ecosystem.
Rapid Rebound and Migration of Malicious Automation
Within 48 hours the same accounts were posting more than before the strike, indicating that the bots either survived the outage or quickly re‑established connections elsewhere. Independent data from Cloudflare showed that malicious traffic migrated to other hosting environments rather than disappearing.
A second, shallower dip occurred after the October 11 strike on Yandex’s Vladimir site, with messages falling 42.6% on October 12 (from 4,711 to 2,704). Even this reduced impact was short‑lived; volumes rebounded to pre‑strike levels by October 10.
The pattern demonstrates a two‑phase dynamic: a physical shock that temporarily throttles output, followed by a rapid adaptive response that restores the original scale of disinformation operations.
Targeted Sub‑Groups and Thematic Focus of the Bot Network
Among the monitored accounts, a subgroup of 98 accounts flagged for justifying the invasion or inciting hatred mirrored the overall traffic curve, dropping 77.8% on October 8 and 49.2% on October 12. This suggests that even tightly curated propaganda clusters are vulnerable to infrastructure disruption.
The CCD’s analysis covered 26 distinct topics within Ukraine’s Facebook and Telegram space, indicating that the bot network was not monolithic but engaged in a broad thematic campaign.
Because the monitoring spanned multiple platforms and topics, the data provides a comprehensive view of how coordinated inauthentic behavior reacts to sudden loss of cloud capacity.
What This Actually Means For You
- Temporary disruption is achievable through physical attacks, but it does not eradicate the underlying bot operators.
- Malicious actors possess the technical agility to relocate workloads across cloud providers within hours, rendering single‑provider knock‑outs ineffective as a long‑term strategy.
- Continuous, multi‑platform monitoring—leveraging tools like Osavul and Cloudflare analytics—is essential to detect both the shock and the subsequent rebound.
- Understanding the composition of sub‑groups (e.g., the 98 extremist accounts) helps prioritize counter‑disinformation resources during and after outages.
- Policymakers should view infrastructure attacks as a tactical lever rather than a strategic solution to information manipulation.
Immediate Action Steps
Analysts should expand their surveillance to include real‑time traffic feeds from multiple CDNs, ensuring that a sudden drop in volume triggers an alert for potential migration. Pairing Osavul‑style account tracking with Cloudflare’s edge‑level data will surface rapid host changes that might otherwise go unnoticed.
In parallel, maintain a rolling baseline of message volume per platform; deviations of more than 30% within a 24‑hour window merit deeper investigation into possible infrastructure‑related disruptions.
Frequently Asked Questions
How much did Russian bot activity drop after the Yandex data center strike?
The CCD reported an 83.6% decline in suspected bot messages on October 8, with daily volume falling from 4,032 to 660 and active accounts dropping from 1,526 to 258.
Did the bots recover after the strike?
Yes. Within 48 hours the same accounts posted more than before, and by October 10 overall traffic had risen back above pre‑strike levels, showing a swift rebound.
Which platforms showed the biggest decline?
Telegram experienced the steepest drop, down 90%, while Facebook saw a 79.5% reduction in bot‑generated posts during the same period.
What Do You Think?
Given the fleeting impact of physical strikes on cloud‑based disinformation, should future defenses focus more on rapid detection and migration tracking than on infrastructure sabotage?