Zelenskyy says fewer bots online, Cloudflare says some just moved

Ukrainian drone strikes damaged three Yandex data centers, disrupting the company's services and other sites that depend on its cloud infrastructure. ^[2][5]

Yandex said operations stopped at its Sasovo facility in the Ryazan region, several modules were disabled at Kaluga, and operations at Vladimir were completely suspended after damage. The disruption spread beyond the company's own services to businesses using its cloud infrastructure. ^[2][4][5]

Cloudflare's October 14 analysis found steep falls in traffic from both Yandex Search and Yandex.Cloud. But the two networks carried different kinds of activity, and their declines tell different stories: the search-network drop consisted almost entirely of verified crawlers, while the cloud network saw less malicious scanning alongside a shift of high-volume automation to other providers. ^[1]

Ukrainian President Volodymyr Zelenskyy offered a broader assessment at the Warsaw Security Forum on October 12. After Ukrainian strikes reached the data centers, he said, it became "a little easier to breathe on many social media platforms", with "less hate, less division and fewer provocations because there were fewer bots." ^[3]

Cloudflare's findings support a narrower conclusion: the attacks disrupted networks, some malicious activity declined, and some automation moved. A hosting outage can interrupt the machines carrying traffic without ending the activity behind it. ^[1]

Three sites, many services

Yandex is a major Russian technology company whose services range from search and email to payments, maps, taxi bookings, food delivery and cloud computing. The attacks therefore reached into several parts of daily life at once. Services reported as affected included Mail, Pay, Disk and Go, alongside websites and services run by other companies on Yandex Cloud. ^[2][5]

The damage varied by site. Yandex said its Sasovo operations had halted. At Kaluga, the company said several modules were completely disabled and warned that some services could be disrupted.

It later reported a complete suspension of operations at Vladimir after damage there. These accounts come from company statements and reporting, rather than an independent inspection of the facilities. ^[2][4][5]

On October 11, Yandex said access to some services had been restored, although some features remained unavailable or restricted. It assured users that money held in Yandex Pay was safe. The head of its financial-technology division said the company could not yet give a precise restoration timeline. ^[2][5]

Reporting also described problems for users outside Russia, extending the disruption beyond the country where the data centers stood. ^[2][5]

Yandex said it was moving customer data and services to other cloud providers. That is one route around damaged infrastructure, although the company's restoration warning showed that moving services and bringing them fully back online were separate tasks. ^[5]

What the traffic figures show

Cloudflare examined two Yandex networks: one used by Yandex Search and another used by Yandex.Cloud. Each has its own internet routing identifier, known as an autonomous system number, allowing traffic from the search operation to be examined separately from traffic hosted in the cloud business. ^[1]

On October 11, traffic was 99% below baseline for Yandex Search and 90% below baseline for Yandex.Cloud. Cloudflare said both remained disrupted through October 13. Its update put traffic at 85% of normal as of 18:00 UTC on October 14. ^[1]

Verified search crawlers are automated programs that visit websites to help build and update search results. Cloudflare said these accounted for almost all the traffic that disappeared from the Yandex Search network. Losing that traffic is evidence of a search operation being interrupted, rather than a count of political accounts falling silent. ^[1]

The cloud network presented a different picture. Cloudflare found a decline in malicious activities such as vulnerability scanning and probing, which look for weaknesses in internet-connected systems. It also said high-volume automation moved to other hosting providers.

Its summary therefore describes both an interruption and a relocation. ^[1]

Cloudflare cautioned that traffic coming from a provider does not identify who controls it. The source material does not independently establish that the strikes disabled Russian influence operations or measurably reduced automated political activity. The detailed bot-data figures and methods are not included in the accessible Cloudflare text, so its summary cannot support a precise count of malicious bots stopped or moved. ^[1][3]

Reports also circulated of reduced online activity around Germany's AfD, Britain's Reform UK and pro-conservative replies on X. Euronews described the wider claims as speculation and said the AfD figures had not been independently verified. ^[3]

Retaliation and recovery

Kyiv described the attacks as a response to Russian strikes on Ukrainian data centers. Zelenskyy said Ukraine was responding to Russian attacks, and the Yandex strikes followed reported Russian strikes on Ukrainian data centers and telecommunications infrastructure. ^[4][5]

Russia's digital development minister said his ministry was discussing data-center protection with the Defense Ministry. ^[5]

Recovery now has two tracks. Yandex is restoring customer services and relocating data, while Russian authorities are considering how to protect the infrastructure. For users still facing restrictions, the next milestone is full service, and Yandex had not given a precise timetable for that restoration. ^[2][5]