Cybersecurity News Fact-Check: The Yandex Strikes Didn't Kill Russian Bots

What is this cybersecurity news story about?

The viral claim: what spread

Within a day of the third strike, posts on X with millions of views (one roundup counted 6.3 million) declared that Russian-run propaganda accounts had gone quiet around Alternative for Germany (AfD), Donald Trump's MAGA movement, and Reform UK communities. The story had political tailwinds:

• At the Warsaw Security Forum on October 12, Volodymyr Zelenskyy said social media had suddenly become "a little easier to breathe." His office later said he had meant the mood online, not a measured drop in bots.
• Czech MEP Tomáš Zdechovský shared a chart claiming AfD-linked activity was down 30%, then 56%.
• Users on X, where the rumor trended hardest, reported their feeds "felt" cleaner — while users on LinkedIn and Threads, where it barely traveled, noticed nothing at all.

That last detail matters: the "cleaner feed" was concentrated exactly where the rumor was spreading — a hint that perception, not measurement, was doing the work.

What actually happened: the strikes were real

None of the debunking below disputes the attacks. Ukrainian drones struck Yandex data centers in Sasovo, Kaluga, and Vladimir between October 8 and 11, 2026. The damage disrupted payments, cloud computing, ride-hailing, and other services millions of Russians rely on. Yandex halted all operations at its Vladimir facility after the third strike. Cloudflare's own data confirms the network impact: traffic from AS13238 (Yandex's primary search network) fell 99% below baseline by October 11, and AS200350 (the cloud segment) dropped 90%. Recovery was slow — levels were still about 15% below normal on October 14.

This is why the myth was so sticky: it was built on two true premises. True premises, wrong inference.

What the chart actually measured

Here is the entire debunk in one paragraph. Cloudflare Radar's chart tracked automated HTTP requests originating from Yandex's network — and 99.5% of AS13238's requests were classified as bot traffic, of which 93.6% earned "verified" status. That traffic was dominated by YandexBot (78.1% of sampled requests), YandexRenderResourcesBot (11.5%), and YandexImages (1.9%) — the crawlers that index web pages and images for Yandex Search. When a company's servers go offline, its crawlers stop crawling. The sharpest fall, 44%, hit the Publishing and Newspapers industry — because crawler requests indexing articles made up roughly 90% of that traffic. The practical effect was reduced search indexing, not silenced trolls.

On a Cloudflare chart, a "bot" is any automated request: a search crawler, an uptime monitor, a scraper. In a social feed, a "bot" is a fake account. The viral claim quietly swapped the first meaning for the second.

What researchers found: no drop in the influence ops

Multiple independent researchers tested the viral claims against actual social-media data — and found nothing:

• Graphika, which maps thousands of online communities, tested each claim and found that none of the named AfD, MAGA, or Reform UK groups lost active accounts or their heaviest posters.
• Cloudflare's own follow-up report (titled "Yandex outage: data shows that instead of going dark, malicious bots went on the move") found that high-volume malicious bot traffic migrated to other Russian hosting providers within hours — with identical fingerprints. The bots didn't die; they moved.
• Russian influence operations don't run through Russian data centers in the first place. They operate through residential proxies and Western VPS providers — the IP footprints of known bot networks never matched Yandex.
• Russian-language Telegram posting dipped 5–15% after the final strike, but researchers could not establish a cause.
• Traffic on X, Facebook, and Instagram stayed steady throughout.
• Researcher Jeremiah Fowler, whose original observation seeded the viral chart, had included a caveat that got stripped out as the posts spread. Analysts including Renée DiResta and Kate Starbird (University of Washington), plus the dTeam researchers, all converged on the same verdict.
• As Meta's H2 2026 report puts it: Russia remains the source of 53 covert influence networks, and "disruption displaces threats; it rarely eliminates them."

Verdict table: what was true, what wasn't

Why so many people believed it

Three forces converged. First, the chart was real data — a genuine 99% collapse is arresting, and few people read past the headline number to ask what was being counted. Second, the story flattered its audience: a satisfying narrative of Ukrainian drones silencing troll farms traveled faster than the boring truth about web crawlers. Third, authority figures repeated it — a wartime president's "easier to breathe" line and a European parliamentarian's charts gave the rumor institutional weight before researchers could check the underlying communities.

The honest lesson is not that everyone who shared it was foolish. The chart looked like evidence, and the inference felt obvious. That is exactly why checking what a metric measures has to be a habit, not an afterthought.

How to read a viral chart: three checks

• 1. What does the metric actually measure? "Bot traffic" on a network chart counts automated HTTP requests. It cannot identify propaganda accounts, which live on social platforms with their own telemetry.
• 2. Who measured it, and with what method? Aggregate network data from one provider can show that something went quiet — but as one threat-intel analyst noted, no outside graph can consolidate bot and troll activity across social platforms without those platforms' internal data.
• 3. What would disprove the claim? The claim died the moment researchers looked at the actual communities named in the posts and found their posters still posting. A chart alone can never show that — only the underlying ground truth can.

Test yourself: the Yandex bots quiz

Frequently asked questions