
On October 11 and 12, a claim spread fast: Ukraine's drone strikes on three Yandex data centers had silenced Russia's social-media bots. The strikes are real, and so is the damage to Yandex's services. But the chart behind the claim counts automated web requests from Yandex's own network, mostly its search crawler, not accounts posting on social media. This page tracks what the data can and cannot show, and what would change our assessment. Why did so many people believe it? Read our analysis at America 2.0 →
Ukraine's strikes knocked out three Yandex data centers and disrupted real services, from cloud computing to payments. The viral "bot traffic" chart counts automated web requests from Yandex's own network, which closely tracks Yandex's own search crawler. No platform report, researcher dataset or posting count yet shows a drop in Russian coordinated activity on social media.
What would change this rating ↓
russianbots.america2.newsAnalysis of Russian influence, information warfare and the networks behind them. Free; unsubscribe anytime.
The most-shared claims, and what public sources can confirm. Tap the link icon to share a single claim.
Origin. Yandex's own statements after drone strikes on its Sasovo (October 7–8), Kaluga (October 9) and Vladimir (October 11) data centers (Reuters).
What the evidence shows. Yandex said Sasovo and Vladimir were shut down completely and Kaluga partly. More than 80 Yandex Cloud services were affected (Kyiv Post), along with ride-hailing, payments, food delivery and chatbots, including Yandex Go outages in five other countries (RFE/RL). Network probes show about 78% of Yandex Cloud's reachable address blocks went dark (IODA, see the chart above), and on October 12 NetBlocks saw "no signs of recovery" (NetBlocks). An IT expert told the Russian newspaper Kommersant that replacing damaged equipment could take up to six months (Ars Technica).
Bottom line. The damage is real and continuing.
Origin. Tom Robinson, co-founder of the blockchain analytics firm Elliptic, on October 12 (X).
What the evidence shows. A7A5 is a ruble-backed stablecoin used to move money around sanctions. Its main exchange moved to Yandex hosting in September 2025, after the token was sanctioned in August. Elliptic's on-chain data shows hourly transactions falling to near zero within hours of the Sasovo strike; most of what remains is swaps on decentralized exchanges. Our own count of public blockchain records shows no recovery as of October 13. On Tron, where most A7A5 moves, transfers fell from 550 to 890 a day (September 28 to October 7) to 35 on October 8 and none at all on October 10 and 11. On Ethereum they fell from about 110 a day to between 5 and 22 (TronGrid and Blockscout data, analyzed by America 2.0).
Bottom line. This is what a real dependency on Yandex looks like in the data.
Origin. A NetBlocks chart posted on October 11 (NetBlocks), repeated by Tom's Hardware and then by many posts as bot figures.
What the evidence shows. The chart is titled "Network Connectivity by Provider." It shows Yandex's cloud network at 30% of normal and its main network at 63%. It measures whether Yandex's networks can be reached. It says nothing about bots.
Bottom line. Accurate numbers, wrong label.
Origin. Tom's Hardware, October 11, citing Cloudflare Radar's "bot traffic" chart for Yandex's network. The article's web address calls it "disinformation bot traffic." Screenshots of the chart spread with captions about troll farms.
What the evidence shows. Cloudflare counts web requests it scores as "likely automated" that come from Yandex's own network (Cloudflare docs). Normally 99.5% of that network's requests are automated, and hour by hour the series moves almost exactly with Yandex's search crawler (correlation 0.996; see the table above). Cloudflare's own posts call the drop "traffic" and do not mention bots or social media (Cloudflare Radar). Asked by BBC Verify, Cloudflare said its data covers all automated requests to websites on its network, including crawlers, and that the drop was "not necessarily bot behaviour on social media platforms" (BBC).
Bottom line. The 0.4% is real. It shows Yandex's search crawler going offline, not social-media bots.
Origin. Viral posts from October 11, then President Zelensky at the Warsaw Security Forum on October 12: "there were fewer bots… it's pretty clear where those bots were coming from" (Euronews); and posts pointing to the replies under a single post, such as one from the White House, as proof that "the bots are completely gone"; and "bot tests," in which users post a provocative line, such as "Vaccines save lives," and judge from the replies whether the bots are gone; and a post seen about 168,000 times crediting the strikes with ending the author’s daily spam calls about a personal loan (post). Zelensky's office later said he meant the atmosphere on social media, not bot activity (BBC).
What the evidence shows. No data was cited. The posting counts we have from known networks show no drop: about 500 pro-Russian accounts on Polish X (Res Futura), the Matryoshka operation's daily videos through October 9, and 10 pro-Kremlin Telegram channels. October 10–11 was a weekend, when most platforms are quieter. A Danish consultancy that tracks 17,000 political accounts found comments on AfD and MAGA Facebook posts at normal levels after the strikes (Valdemar Osted). The tone of the replies under one post depends on who sees it and chooses to respond; without comparing many posts over time, it cannot show a change in bot activity. A "bot test" post draws replies from whoever sees it, including people joining the joke, and has nothing to compare against. Spam phone calls are not social-media activity, and nothing links them to Yandex’s data centers.
Bottom line. Impressions, not measurements.
Origin. X's Global Government Affairs account said on October 14 that X “recently identified and suspended more than 13,000 accounts involved in three suspected foreign influence operations linked to Iran, Russia, and China” (X); accounts on X cited it as the reason feeds felt quieter (X).
What the evidence shows. X gave no dates and no count for the Russia-linked network. A takedown can change what some users see, but researchers who track Russian influence accounts measured no drop in their activity (see What we know).
Bottom line. A real takedown, not evidence that Russian bot activity fell.
Origin. A chart posted by Czech MEP Tomáš Zdechovský on October 11 ("If confirmed…"), recaptioned by Polish analyst Jarosław Wolski as a 56% fall in AfD support. The two posts drew about 100,000 likes. Wolski retracted his on October 13 (Wolski).
What the evidence shows. The chart names no source, platform or metric, does not mention AfD, and plots values for dates after it was posted. Capital traced it to a Threads post that Meta labels as AI-generated content (Capital). Asked for a source, the Threads user who first posted it, with the caption "AfD postings since the Russian data centres were hit," replied "Gut feeling"; the post has since been deleted (Antibot4Navalny, translated from German). Asked where the chart came from, Zdechovský's office did not say, according to OCCRP editor Ilya Lozovsky (X). Zdechovský later told Novinky.cz he should have checked its origin and data more thoroughly (Novinky.cz). The German fact-checker Rohtext found X posts about every major party fell over the weekend, the SPD and Greens more than the AfD (Rohtext). Kate Starbird of the University of Washington charted X posts mentioning the AfD hour by hour from October 5 to 13 and found no drop around the strikes, just a normal daily pattern (Bluesky). Graphika counted 40,365 posts from 1,022 accounts in AfD-related communities on October 11, against 42,040 from 1,037 a week earlier, a 4% dip within the community’s normal week-to-week range (Graphika).
Bottom line. The chart cannot support the claim, and its author has stepped back from it.
Origin. An anonymous analysis of Reddit activity around the three strikes, posted to r/theydidthemath on October 12 with its data and code. Cropped images of its tables spread on X the same day, and Polymarket posted that "several major U.S. political subreddits" had plunged, naming none. The forum's moderators later removed the post; its author said the code and calculations were produced with ChatGPT and posted it for others to check.
What the study did. It took hourly post and comment counts for 1,221 subreddits (968 busy enough to analyze) from the social-listening service Syften, and compared the 12 hours after each strike with the 12 hours before, adjusting each hour against the same hour and weekday in the three previous weeks. It then re-ran the test with other start times, 10-hour windows and a Reddit-wide benchmark.
What it found. 90 subreddits fell after all three strikes. None stayed down across the timing checks. The author's conclusion: "No ranked community is a timing-stable result," and the results are "not evidence of bots, server use or causation." The author also notes this "does not prove there was no effect." In the study's data, 77 subreddits rose after all three strikes, about what chance would produce alongside the 90 that fell. The 80% figure that spread is one 12-hour window in r/irishpolitics; starting it six hours later turns it into a 49% rise. The author asked whether comparing against unrelated dates would be a better test. We ran that comparison: on an ordinary Sunday a week earlier, as many political communities fell by more than half as on the day of the Vladimir outage (see the "A/B test" claim). Graphika repeated the comparison with public Reddit counts: 13 of 18 post-strike comparisons across six subreddits fell within normal range. r/irishpolitics after Kaluga came out at −54%, and moving the window a few hours turned it into a rise of up to 109% (Graphika).
Bottom line. A careful study, done in the open, that found no reliable drop. Its own author says so.
Origin. An X post on October 12 by @tleilax___, a pseudonymous account that describes itself as a commodity portfolio manager, apparently using the same public Reddit data as the anonymous study, compared 147 political and regional subreddits with 825 others during the Vladimir outage (01:00–12:00 UTC, October 11), and listed the political ones that fell most, led by r/democraticparty (−71%).
What the evidence shows. We re-ran the comparison on the same data (the study's public archive, 24.6 MB). Over that window the median political community fell 7.8% and the median other community fell 6.4%, almost the same; 66 of the 147 political communities rose. A week earlier, on Sunday, October 4, with no strike, the same number of political communities (10) fell by more than half, including r/democraticparty (about −75%) and r/illinois (about −60%). Small communities swing like this all the time; a list of only the biggest decliners hides that.
Bottom line. The political communities moved like the rest, and the "collapses" happen on ordinary days too.
Origin. An X post on October 11, seen more than 600,000 times, sharing charts from X's own trends tool. They showed posts mentioning "Zelensky" rising while "genocide" and "Free Palestine" fell.
What the evidence shows. The charts were captured about 18:00 UTC on October 11, so the last point covers only three-quarters of a day; the drops of about a quarter match that. Both terms peaked on October 7, the anniversary of Hamas's 2023 attack; a fall after an anniversary spike is expected, strike or no strike. "Zelensky" rose with that week's news about Ukraine, including the strikes themselves. The tool counts posts on a topic; it cannot tell who posted them or whether they were automated.
Bottom line. A partial day and an anniversary, not a bot effect.
Origin. A post sharing a Google Trends screenshot that showed Canadian interest in the Conservative Party "down 60%" (October 12, about 250,000 views), and posts on Facebook, Threads and Reddit saying Alberta separatist posts and websites had gone quiet, a week before Alberta's October 19 independence referendum (Elections Alberta). The most widely seen version, an October 11 X post (about 280,000 views), said Alberta separatist accounts "fell off the face of the earth." Another (about 65,000 views) compared single posts by four accounts, including Premier Danielle Smith's, to claim their views fell 38% to 97%.
What the evidence shows. Google Trends measures Google searches by people in Canada, not social-media posts, and the screenshot covered Canadian Thanksgiving weekend. The Alberta Prosperity Project, a leading group campaigning for independence, had its website online on October 12. A site Canadian researchers have tied to the Russian operation Storm-1516, albertaseparatist.com, went dark long before the strikes: its domain was re-registered in July 2026 and is parked for sale (DisinfoWatch; domain records). We measured all four accounts' original posts. The middle (median) post on Smith's account drew about 50,000 views before the strikes and about 53,000 in the three days after; two of the others were flat or up, and the fourth dipped on October 8–10 but was back to its usual level by October 11–12. One "before" example in the comparison was posted after the first strike. Posting under #AlbertaIndependence was still heavy on October 12.
Bottom line. Neither shows a bot effect. Foreign interference in the referendum is a documented concern, but this is not evidence about it.
Origin. X posts on October 12 claiming that Elon Musk "loses 100M followers" (seen more than 580,000 times) and that the MAGA influencer Gunther Eagleman "lost a half a million followers."
What the evidence shows. CalMatters put Musk at 241 million followers on October 8, before the first strike (CalMatters); his account showed about 241.5 million on the evening of October 12. Gunther Eagleman had 1.7 million followers in September (The Daily Beast); his account showed about 1.77 million on October 12. Neither number fell.
Bottom line. The follower counts did not drop.
Origin. Tomasz Siemoniak, Poland's minister coordinating the intelligence services, said on October 12 that the Internal Security Agency (ABW) had seen "a significant, radical drop" in Russian bot activity and that, after the strikes, Russian bot traffic had "practically stopped" worldwide (Rzeczpospolita).
What the evidence shows. No data has been released. NASK, Poland's state research institute for cybersecurity, analyzed the Russian disinformation accounts it monitors on X from September 30 to October 11 and found no significant decline in their activity after the strikes; only a few individual accounts stopped, with no basis to tie that to the strikes (Interia). The Prime Minister's office posted Siemoniak's remark on X (KPRM). Twenty-four minutes earlier, at the same briefing, it quoted Deputy Prime Minister Krzysztof Gawkowski, the digital affairs minister: "In recent hours we have been observing the spread of disinformation and the activity of Russian bots" (KPRM, translated from Polish).
Bottom line. Poland's own research institute found no drop.
Origin. An X post on October 12 by a critical-care doctor (about 680,000 views) sharing Google Trends charts and a table showing searches for terms such as "turbo cancer," "ivermectin cancer" and "spike protein detox" lower on October 8–10 than on October 1–3. In a follow-up essay (Substack), he called it "an imperfect comparison" and wrote that a proper analysis would need to account for baseline trends and include unrelated control searches, while still calling the strikes "an unexpected public health win."
What the evidence shows. We ran that analysis. Every term, and neutral health searches such as "vitamin d" and "cancer symptoms," peaked around September 20 and had been falling since. Most fell as much or more in the week before the strikes as after them; "turbo cancer" lost more than half its weekly volume in the week ending October 3. The neutral terms held steady after the strikes. The sharpest drop in the posted charts is the current week, which Google marks as incomplete. Google Trends counts searches by people, and filters out automated queries, so it cannot measure bot activity.
Bottom line. A decline already under way, not a bot effect.
Origin. An X post on October 12 by an infectious-disease doctor (about 48,000 views) sharing a chart from X's trends tool showing mentions of "Fauci" falling from about 36,000 a day on October 8 to under 10,000 by October 11.
What the evidence shows. The chart starts on the day of the first strike, so it shows no "before." It starts at a peak: on October 7, Sen. Rand Paul released a new batch of Fauci's private diary entries, which drove a burst of coverage (Newsweek). Mentions of any topic fade after a news spike like that. The tool counts posts on a topic; it cannot tell who posted them or whether they were automated. Graphika’s own count shows the same shape: 4,984 mentions on October 8, back to 1,677 on October 10, close to the week before Paul’s release (Graphika).
Bottom line. A news cycle fading, not a bot effect.
Origin. The Czech news site iDNES on October 12, amplified by Zdechovský ("Coincidence?"), naming a site it called "AC.CZ."
What the evidence shows. AC24.cz, a well-known Czech disinformation site with a similar name, published three articles that Monday, according to its own feed, and is hosted in France, not on Yandex. We could not find a working site at ac.cz.
Bottom line. The example does not hold up.
Origin. Viral posts noting that the Sasovo site housed two of Yandex's three AI supercomputers, which train its YandexGPT models; and a widely shared thread (about 250,000 views) that correctly identified the crawler traffic but asserted, without sources, that bot farms had lost YandexGPT and Yandex's translation tools, and that "crawlers that spread, clone, and rank" propaganda sites were frozen.
What the evidence shows. No report ties Yandex's supercomputers or YandexGPT to any influence operation. Supercomputers like these train models rather than run accounts, and operations that use AI tools can choose among many providers or run models on their own machines. The influence-operation websites we checked are hosted elsewhere. Yandex's crawler indexes websites for Yandex's own search engine; it does not spread or copy them, and its outage does not change what audiences outside Russia see.
Bottom line. An inference from location, with no evidence behind it.
Origin. Anonymous X accounts comparing single posts, such as two posts by President Trump on different days; and a London Economic "exclusive" on October 12 setting posts by Reform UK figures Nigel Farage, Richard Tice and Zia Yusuf that were a few hours old against their posts from the week before; and, from the other side, posts inviting followers to "interact" with a post to show that their views are real rather than bot-driven; and posts holding up a single celebrity post, such as one by Elon Musk with fewer than 5,000 likes, as proof; and a dashboard screenshot posted October 13 showing Elon Musk "down 1.5m engagements in the last 5 days" among right-leaning accounts (@fuckyouiquit); and Futurism on October 13, which reported Musk’s average likes per day falling from 17,000–81,000 earlier in October to 11,000 and 8,000 over the previous two days, while saying it “can’t determine a causal relationship” (Futurism); and a chart of posts by Farage, Reform UK, Zia Yusuf, Rupert Lowe and Restore Britain, shared on October 13 by Ecotricity founder Dale Vince as an “incredibly big and clear drop” showing that “Reform have support from Russia whether they know it or not” (post).
What the evidence shows. Posts keep gathering views and reposts for a day or more, so a post a few hours old will always look weaker than last week's. Engagement also varies widely from post to post with topic, timing and day of the week, so comparing a handful of posts proves little. Engagement totals for the biggest accounts swing by millions from one week to the next with the news cycle; a five-day comparison with no control group, such as left-leaning accounts over the same days, cannot separate bots from an ordinary slow news week. The one chart of slogan reach that showed a drop (October 8–10) gave no method, and reach rebounded on October 11, the day of the largest outage. Our own test of eight pro-Kremlin accounts found likes and reposts per post at their usual levels on October 8–10; October 11 is too recent to judge, and we will update. A post that draws heavy engagement from its own followers shows only that those followers respond when asked; it says nothing about whether bots were ever present or have gone. One account's numbers swing widely with topic and with how the platform shows its posts. In a sample of Musk's original posts on October 11, most still drew more than 5,000 likes; the median was lower than a week earlier, but those posts were still gathering engagement when we counted them. That chart begins on October 9, after the first strike, so it has no before; the drop it shows is in posts only hours old. Farage’s October 11 afternoon post, plotted at about 27,000 engagements, now has about 35,000, the most of any post in the window, on the day of the Vladimir strike.
Bottom line. Not evidence of a cause.
People who spread the "bots went silent" story and have since taken it back, and the fact-checks that tested it. Newest first. We add to this list as corrections appear.
| Date | Who, and what they had said | What changed |
|---|---|---|
| Oct 13 | Volodymyr Zelensky, President of Ukraine: said at the Warsaw Security Forum on October 12 that "there were fewer bots… it's pretty clear where those bots were coming from" (Euronews). | Clarified His office told BBC Verify he was "talking about the atmosphere on social media" rather than a fall in bot activity, citing "reports of fewer provocative and hateful comments" (BBC). |
| Oct 13 | Jarosław Wolski, Polish defense analyst: AfD support online "fell 56%" (43,800 likes). | Retracted Apologized, said the chart was AI-generated and that no lasting, measurable drop in pro-AfD posts had occurred, and said he had deleted the post (Wolski). |
| Oct 12 | Michał Fiszer, Polish military pilot and commentator: argued the strikes had an indirect effect on the reach of radical parties' accounts (about 20,000 views). | Walked back Hours later, "after further analysis": the strikes "will ultimately have no effect on Russian disinformation" (Fiszer, translated from Polish). |
| Oct 12 | A German Green Party local councillor who reshared the AfD chart (about 2,000 likes). | Retracted "I wanted it to be true" (Capital, translated from German). |
| Oct 12 | Tomáš Zdechovský, Czech member of the European Parliament: posted the unsourced AfD chart, "If confirmed, this is telling" (55,900 likes). | Walked back Said "if confirmed" meant the link was not a verified fact, and told Novinky.cz he should have checked the chart's origin and data more thoroughly (Zdechovský, Novinky.cz). To ZDFheute he said he has “no independently verifiable data” linking the strikes to a drop in disinformation activity and should “perhaps have been clearer that the original source is missing and that the graphic was not independently verified” (ZDFheute, translated from German). As of October 13 the post remained pinned to the top of his X profile (BBC). |
Fact-checks so far (October 12–13): Capital, Rohtext, BR24 #Faktenfuchs, netzpolitik.org, FAZ and ZDFheute (Germany), Novinky.cz (Czech Republic), Interia and Niebezpiecznik (Poland), Libération CheckNews (France), Euronews, The Verge, RFE/RL The Independent, BBC Verify, The Guardian and Mother Jones. None found evidence that Russian influence operations went quiet.
Not corrected as of October 13: Tom's Hardware's "bot traffic nearly eliminated" article (headline and date unchanged); Polish Minister Tomasz Siemoniak's statement that the ABW saw Russian bot traffic "practically stop" (no data released); and Ukraine's Center for Strategic Communications' post sharing the AfD chart.
New reporting from major outlets and official sources, listed as it appears. Our monitoring adds headlines from major outlets automatically. "Checked" means our software fetched the full report and confirmed it supports its headline. "Reviewed" means an editor checked it against its source. "Auto" items have not been checked yet. Tap a label for our note. None of this is an endorsement. Our assessment is the rating above.
Anecdotes ("everyone noticed") and the Cloudflare chart cannot move this rating. Any one of these could:
Every chart in circulation that names its data source measures Yandex's own infrastructure. Each shows servers going dark, which is what you would expect from destroyed data centers.
| Measure | What it counts | What it shows |
|---|---|---|
| Cloudflare Radar "bot traffic," Yandex network (AS13238): the viral chart | Automated HTTP requests from Yandex's own network to Cloudflare-served websites | Fell 99% from the prior week around 00:30 UTC Oct. 11, when Vladimir shut down (Cloudflare Radar) |
| Cloudflare's verified YandexBot crawler | Requests from Yandex's search-engine crawler | Moves almost exactly with the viral chart: hour by hour over two weeks the two correlate at 0.996 (Google's crawler: 0.17). Normally 99.5% of requests from Yandex's network are automated (Cloudflare Radar data, analyzed by America 2.0; first shown side by side by Antibot4Navalny) |
| Cloudflare bot traffic from all of Russia | Share of Russian web requests that are automated | Slipped from about 49% in the days before the strikes to about 44% after, consistent with losing Yandex's crawler; it had already been drifting down from about 55% in late September (Cloudflare Radar data, analyzed by America 2.0) |
| Application-layer DDoS attacks originating from Russia | Attack requests from Russian IP addresses, per Cloudflare | No drop: October 8–11 at 90–95% of the two-week peak, the same range as the week before. Russia was not among the top six origin countries for such attacks that week. (Cloudflare Radar data, analyzed by America 2.0) |
| NetBlocks connectivity | Reachability of Yandex networks | Yandex Cloud at 30% of normal, Yandex LLC at 63%, on Oct. 11 (NetBlocks). These are the "30%" and "63%" figures quoted as bot numbers. |
| A7A5 stablecoin transactions | On-chain transfers of the sanctioned ruble stablecoin, whose exchange is hosted by Yandex | Collapsed within hours of the Sasovo strike (Elliptic's Tom Robinson). Still under a tenth of normal on October 13, by our count. A known dependency on Yandex shows up clearly in the data. |
| Pravda network articles | Articles published, from the network's own sitemaps | About half of normal for roughly 13 hours after Vladimir; normal after Sasovo and Kaluga |
| 10 pro-Kremlin Telegram channels | Public posts | No drop; 20% above normal in the 12 hours after Vladimir |
| Engagement on eight pro-Kremlin X accounts (four Russian state accounts, including RT and Sputnik, and four large commentary accounts) | Median likes and reposts per post, up to 20 posts a day each | Normal after Sasovo and Kaluga (October 8–10: 99–114% of each account's usual level). Too soon to judge October 11; we will re-measure once those posts have aged. (Analysis by America 2.0) |
| Nearly 10,000 accounts on TikTok, Telegram and X in German-speaking countries (disinformation actors, AfD-aligned and pro-Russian) | Posting activity and new-account creation | No statistically noticeable drop (Polisphere, with the Hasso Plattner Institute, via Capital) |
| Comments on 76 AfD politicians' and 136 MAGA accounts' Facebook posts | Each post against that account's normal (same post age, weekday, time of day) | No collapse: AfD −8% to +5%, MAGA +4% to +10%; MAGA posts drew 480,000–560,000 comments a day after the strikes, against about 370,000 in late September (Common Consultancy, via Valdemar Osted) |
| Russian disinformation accounts monitored by NASK on X (Polish) | Overall activity, September 30–October 11 | No significant decline after the strikes (NASK, via Interia) |
| Posting by ~500 pro-Russian accounts on Polish X | Posts by a monitored network, and replies under them | No drop. The busiest stretch was Sunday afternoon, after the Vladimir shutdown; the analysts call it "a classic weekend" (Res Futura Data House) |
There are real ways a Yandex outage could slow a Russian operation: Yandex mail, cloud hosting, its AI and speech tools, or its payment apps. Some Russian state media do depend on Yandex. RT, the video agency Viory and the pro-Kremlin site Anti-Spiegel route their email through it. And when a known dependency breaks, it shows: the sanctioned A7A5 stablecoin's transactions collapsed with the first strike (Elliptic).
But the evidence stops there. The web fronts of known operations that we checked (the "Pravda" network and a Doppelgänger fake-news site) are hosted elsewhere. No report ties YandexGPT, Yandex Cloud or Yandex Pay to a troll operation. The posting data is mixed in one telling way. Matryoshka posted 8 to 10 videos a day on X from October 5 to 9, through the Sasovo and Kaluga strikes, according to daily logs kept by volunteer researchers, and 10 pro-Kremlin Telegram channels did not slow. But the automated "Pravda" news network lost about half its output for 13 hours after the Vladimir shutdown, while its Telegram sources were busier than usual, then recovered. That is consistent with an automated pipeline that leaned on something in a Yandex data center and quickly routed around it. It is a website network, not social-media accounts, and we cannot see which part of it failed. Ukraine's Center for Countering Disinformation, a government body, said on October 13 that it found no evidence of "a significant overall decline" in Russian bot networks' activity, but that output from the Pravda, InfoDefense and "Nod of Time" networks fell by about half for around 12 hours before recovering (CCD). It published no data. Its Pravda finding matches ours; five of InfoDefense's public Telegram channels that we checked showed no such dip, and were busier than usual after the Vladimir strike. On Monday, October 12, the first weekday after the Vladimir strike, the logs show 5 videos from two accounts, about half the usual; David Colon of Sciences Po, who also tracks the operation, counted the same (Colon, in French). On October 13, after checking his own records, Colon found similar drops on September 3 and 14 (Colon). But the same thing happened on Monday, September 14, four weeks before the strikes: two accounts set up the Friday before posted five videos between them, and no new accounts appeared. Since mid-August, Mondays have run lower than other weekdays (a median of 7.5 videos, against 10), and three earlier Mondays (August 31, September 7 and 14) looked like October 12. So a half-size Monday is not unusual for this operation; the next two weekdays will show whether output stays low.
The closest precedent points the other way from this week's evidence, and shows what a real test looks like. During a two-hour, nationwide Russian internet outage in January 2024, researchers at the Brussels think tank Bruegel found that posts from 221 X accounts popular with pro-Kremlin networks drew about 49 fewer reposts per account in the peak hour than a control group and the day before. The authors called the results preliminary (Bruegel). That outage hit the whole Russian internet; this week's strikes hit three data centers belonging to one company.
The most specific example so far comes from David Colon, who teaches about propaganda at Sciences Po: a fabricated story from the Russian operation Storm-1516 about the French candidate Raphaël Glucksmann, launched October 9, drew only tens of thousands of views in its first three days, while one the network launched on September 24 drew millions in the same span (X). It compares two stories, which can differ in topic, target and who picks them up, and the October 9 story came before the largest outage. It is worth testing across many stories.
What would make the case: posting or engagement counts for known network accounts that dip after all three strikes, more after the biggest outage, and not just on weekends. We will add such data here if it appears.
It is easy to see why the claim spread. The strikes are a real blow to Russia's largest technology company, and many people want them to have hurt the Kremlin's online operations too.
But believing it before the evidence is in has costs. If people think the troll farms have gone quiet, Russia's operations can carry on with less scrutiny. Policymakers, platforms and the public come away with the wrong picture of how these operations work: as servers that can be bombed, rather than paid people and contractors spread across many countries and tools. And a misread chart, repeated by officials and newsrooms, becomes faulty intelligence. It distorts judgments about what the strikes achieved and what still needs doing.
Ukraine and its supporters need accurate situational awareness more than good news. The strikes' documented effects, on Yandex's services, on payments and on a sanctioned stablecoin, are real and significant. Claiming effects the evidence does not show only makes the real ones harder to see.
Research on Russian influence operations describes a decentralized business: scholars write of "entrepreneurs of influence" competing for Kremlin favor (Laruelle and Limonier, Post-Soviet Affairs, 2021) and of a disinformation labor market (Poliakoff and Kling, New Media & Society, 2026). Much of the work is done by people paid to meet quotas: the Senate Intelligence Committee documented Internet Research Agency staff with daily targets for posts and comments (Senate report, Vol. 2), in an operation researchers called "industrial" (Linvill and Warren, Political Communication, 2020). Some of it runs outside Russia: in 2020 an operation linked to former IRA associates paid people in Ghana to post for American audiences (Graphika). The trade also runs on plain profit: Leslie Iwerks' documentary Selling Lies follows young people in North Macedonia who earned large sums in 2016 running fake political news sites aimed at American readers (Selling Lies). Human-run accounts are hard to tell from real users; even research tools built to detect bots misclassify in both directions (Rauchfleisch and Kaiser, PLOS ONE, 2020). Operations that used a Yandex service, such as payments, translation or the YandexGPT model, would lose it for a time. Swapping in another provider, or a model run on their own machines, is usually quick.
That is why the data that matters is posting data from known networks. Traffic from a search company's servers cannot tell us whether those networks went quiet. The contrast is the point. Russia's domestic digital economy runs through a few large Yandex data centers, which is why the strikes did real damage there (Ars Technica). Influence operations are spread across many countries, contractors and tools.
If you have a validated study, a news report or credible analysis that measures Russian online activity before and after the Yandex strikes, email us at editor@america2.news with the subject “Russian Bot Tracker.” Posting or engagement counts for known network accounts are the most useful. Please include a link and say how the data was gathered. We check each submission against its source. If it holds up, it goes on this page, whichever way it points.