Russian bot activity drops 84% after Yandex strikes, rebounds in 48 hours
Ukraine’s CCD reports a sharp decline in automated posts following infrastructure hits, but volume quickly recovered as automation migrated to other clouds.
Key points
- Suspected Russian bot message volume fell 83.6% on October 8 after a drone strike disabled Yandex's Sasovo data center.
- Activity returned to pre-strike levels by October 10, indicating rapid migration of automation to rival cloud infrastructure.
- A second strike on October 11 caused a smaller 42.6% dip, while a partial outage in Kaluga showed no impact on bot activity.
Ukraine’s Center for Countering Disinformation (CCD) reported that suspected Russian bot activity collapsed by 83.6% on October 8, following a drone strike that shut down Yandex’s Sasovo data center. This sharp decline suggests that a significant portion of the automated disinformation infrastructure relied on Yandex Cloud services for hosting or processing.
The CCD’s analytical report, dated October 15, 2026, tracked 22,664 messages from 5,201 accounts exhibiting inauthentic behavior across Facebook and Telegram. The data reveals that the silence was temporary, with message volumes returning to above pre-strike levels by October 10. Independent analysis from Cloudflare indicates that the automation did not cease but rather migrated to alternative cloud providers.
Infrastructure Impact and Recovery
The initial drop occurred hours after the Sasovo facility in the Ryazan region was struck. Daily messages fell from 4,032 to 660, and active accounts dropped from 1,526 to 258. Telegram activity declined by 90%, while Facebook saw a 79.5% reduction. A second strike on October 11, which Yandex said halted its Vladimir site, caused a further 42.6% drop in messages on October 12.
The correlation between physical damage and bot activity is evident. A strike on October 9 at Yandex’s Kaluga campus, which only partially took the site offline, resulted in no measurable fall in bot activity. This contrast highlights that complete infrastructure shutdowns are required to disrupt these networks significantly.
Scope and Actor Behavior
The CCD monitored 26 topics within Ukraine’s digital space between October 6 and 12. A specific subgroup of 98 accounts, flagged for justifying the invasion or inciting hatred, followed the same decline pattern, dropping 77.8% on October 8 and 49.2% on October 12. However, the rapid recovery suggests that operators have redundant infrastructure or quick migration protocols in place.
Cloudflare and Graphika noted that Western political communities did not experience a comparable drop in activity. Russian-language Telegram output in those spaces fell only 5% to 15%. This discrepancy implies that the Yandex-dependent bots were primarily targeted at Ukrainian audiences or operated within specific regional clusters rather than global networks.
What should you do?
Security professionals should monitor for sudden shifts in traffic sources or hosting providers following major infrastructure events. The rapid migration of bot networks demonstrates that adversaries maintain flexible deployment strategies. Analysts should look for new IP ranges or cloud providers emerging immediately after known disruptions to existing bot infrastructure.
What to do and how to stay safe: Yandex
- Monitor network logs for sudden changes in source IP ranges or hosting providers following reported infrastructure outages.
- Track message volume spikes on social platforms that may indicate migrated bot activity resuming operations.
- Verify the authenticity of high-volume accounts that reappear quickly after known disruptions to their previous hosting environments.
- Coordinate with cloud providers to identify and block traffic originating from newly provisioned resources linked to known bad actors.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the Yandex strikes permanently stop Russian bot activity?
No, the CCD report shows that bot volume returned to pre-strike levels within two days, indicating the automation migrated to other infrastructure.
Which social platforms were most affected by the infrastructure shutdowns?
Telegram experienced the largest drop at 90%, followed by Facebook with a 79.5% decline in message volume on October 8.
Did Western audiences see a similar drop in bot activity?
No, Cloudflare and Graphika found no comparable drop in Western political communities, with Russian-language Telegram output falling only 5% to 15%.
