Malicious automation fled Yandex infrastructure after strikes, shifting to other networks despite crawler halt

Cloudflare analysis shows that malicious bots did not cease operations after strikes hit Yandex data centers in Russia. According to the cybersecurity firm’s first-hand research, published on its blog, automated threats simply migrated to other networks instead of going dark. This finding contradicts earlier Internet speculation that the physical damage had successfully knocked Russian bot farms and influence operations offline.

The strikes occurred between October 7 and 11, targeting three Yandex facilities. By October 11, network traffic had collapsed significantly. Traffic for Yandex Search (AS13238) plummeted to 99% below baseline, while Yandex.Cloud (AS200350) fell 90% below normal levels. Despite a brief partial recovery, both networks remained disrupted through October 13, settling at 86-90% below their pre-event baselines. As of October 14 at 18:00 UTC, traffic had returned to 85% of normal levels.

Impact on Automated Traffic Types

Aggregate HTTP traffic drops can be misleading indicators of malicious activity cessation. Cloudflare’s analysis of its Radar and Bot Management data reveals distinct impacts on Yandex’s two autonomous systems. Yandex Search (AS13238) primarily handles search index crawling. Before the strikes, 99.5% of its requests were automated, with 93.6% classified as verified bots. These requests consistently indexed pages, rendered images, and accessed site resources, confirming their legitimate search-engine nature.

In contrast, Yandex.Cloud (AS200350) hosted a different mix of automation. Approximately 95.0% of its scored requests were bots, but none were verified by Cloudflare. These unverified bots behaved like software applications, with nearly two-thirds sending data to websites. Some identified themselves as JavaScript, Python, or Go programs. This ASN directed a larger share of traffic to software companies than the search bots did.

Migration of Malicious Automation

The decline in Yandex.Cloud traffic included a drop in malicious activities such as vulnerability scanning and probing. However, high-volume automation did not vanish entirely. According to Cloudflare, this traffic simply migrated to other hosting providers. This migration explains why global malicious traffic levels did not show a corresponding disruption linked to the Yandex outage. The source of the traffic does not necessarily indicate the responsibility for the activity.

Before the strikes, automated requests accounted for 36.1% of all HTTP traffic globally on Cloudflare’s network. Automated requests also accounted for 35.8% of traffic from Russian IP addresses. Yandex Search supplied about 7% of Russia-origin bot requests and just 0.05% of the global total. Yandex.Cloud contributed approximately 2% of Russia-origin bot requests and only 0.01% of the global total.

What should you do?

Security teams should monitor for shifts in bot behavior rather than relying solely on aggregate traffic drops from specific providers. When a major infrastructure outage occurs, attackers may move their operations to alternative hosting environments. Analysts should examine request behavior, such as user-agent strings and data submission patterns, to identify migrated malicious automation.

Background: Autonomous system numbers (ASNs) in threat intelligence

Autonomous System Numbers (ASNs) identify large network blocks owned by a single entity, such as an ISP or cloud provider. In threat intelligence, ASNs help you attribute traffic to the correct organization, bypassing misleading domain names and dynamic IP addresses used by attackers to hide their true location.

Read the full guide: Autonomous System Numbers in Threat Intelligence Explained

What to do and how to stay safe: Cloudflare

• Analyze request behavior patterns, such as data submission methods and program identification, to detect migrated malicious bots.
• Monitor traffic from alternative hosting providers for sudden increases in unverified automation following major infrastructure outages.
• Verify bot identities using classification tools to distinguish between legitimate search crawlers and unverified scanning activity.
• Review baseline automation metrics to identify deviations that may indicate the relocation of malicious operations.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the Yandex data center strikes stop all Russian bot traffic?

No, Cloudflare data shows that while verified search crawlers stopped, malicious bots migrated to other hosting providers.

What was the difference between Yandex Search and Yandex.Cloud traffic?

Yandex Search traffic consisted mostly of verified crawlers, while Yandex.Cloud traffic was largely unverified automation and scanning.

How much did traffic drop for Yandex Search on October 11?

Traffic for Yandex Search (AS13238) plummeted to 99% below its baseline on October 11.