Friday 16 October 2026
Night Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Yandex data center strikes slow, but do not stop, Russian bot traffic, Cloudflare finds

Malicious workloads migrated to other hosting providers as automation operators adapted within hours

By LineZotpaper
Published
Read Time2 min
Ukrainian drone strikes on Yandex data centers have sharply disrupted Russian cloud services but have done little to reduce Russian disinformation bot traffic, according to a new Cloudflare analysis. Traffic on Yandex Search and Yandex.Cloud remains at 10% to 15% of normal levels, yet malicious bot activity quickly migrated to other hosting providers, leaving overall Russian bot traffic essentially flat.

Cloudflare's analysis of the aftermath of recent Ukrainian strikes on Yandex's largest data centers found that while the attacks slowed overall bot traffic from Russia, malicious bots largely transferred to other hosting ASNs, including Radist and Selectel.

Traffic on Yandex Search, which Cloudflare said is composed mostly of verified search crawlers, is mostly legitimate. Yandex.Cloud, by contrast, experienced a drop in malicious activities such as vulnerability scanning and probing after the strikes. But Cloudflare said "high-volume automation did not vanish, it simply migrated to other hosting providers."

One Cloudflare customer in the gambling sector saw malicious bot requests from Yandex.Cloud drop to zero, only for the same activity to reappear through other networks. "Overall, Russian bot traffic targeting gambling accounts remained essentially flat over the week, moving from 167.7 million to 170.1 million requests (+1.4%)," the company wrote. "The automation never stopped running; the operators simply migrated their workloads to alternate cloud providers once Yandex.Cloud became unavailable."

Cloudflare found a similar pattern on social media: traffic from Russian-origin IPs dropped only 0.6% over the same period, and Russian bot traffic hitting "post," "reply," and "like" on one platform decreased by just 5.7%. The company said this debunks the theory that the Ukrainian strikes caused a meaningful drop in social media manipulation, while noting the analysis is limited to traffic that passed through Cloudflare services.

Cloudflare observed that cloud-based workloads can be moved between data centers easily, so taking out physical infrastructure does not necessarily end the services running on it. The company pointed to Amazon advising customers affected by Iranian strikes on AWS Bahrain and AWS Abu Dhabi to find safer locations for their data as a similar example. Defending against bot networks is difficult, Cloudflare said, because operators can move to another provider in hours and quickly return to normal traffic levels.

§

Analysis

Why This Matters

  • Ukrainian strikes on Russian cloud infrastructure were aimed at degrading disinformation operations, but the effect appears limited because bot operators can rapidly shift to other providers.
  • The findings highlight the resilience of automated influence networks and the challenge of disrupting them through physical attacks alone.
  • For companies defending against abuse, the episode underscores that blocking IP prefixes or infrastructure is only a temporary measure.

Background

Cloudflare publishes analyses of internet traffic trends and outages, and its visibility into large volumes of global web traffic allows it to observe shifts in bot behavior. The strikes on Yandex data centers were part of a broader Ukrainian campaign to hit Russian infrastructure in response to Russian strikes on Ukrainian data centers. Yandex, often described as Russia's equivalent of Google, operates widely used search and cloud services. The incident also follows a pattern of data center attacks in the region, including Iranian strikes on AWS facilities in Abu Dhabi and Bahrain.

Key Perspectives

Ukrainian military and government: Strikes on Yandex data centers are intended to degrade Russian military and disinformation capabilities. The disruption to Yandex services shows the attacks caused significant operational damage, even if bot traffic later recovered.

Cloudflare researchers: Their data shows that while physical infrastructure was damaged, the automation behind disinformation campaigns simply relocated. They emphasize that traffic on Yandex services remains far below normal, but malicious activity on other networks continued largely unchanged.

Critics and skeptics: The limited drop in Russian-origin bot traffic suggests that targeting data centers may not meaningfully reduce disinformation. Given Cloudflare's analysis is confined to traffic visible to Cloudflare, the true scale of bot activity outside that scope remains unknown.

What to Watch

  • Whether Russian bot traffic returns fully to Yandex.Cloud as services recover, or remains distributed across alternative hosting providers.
  • Any further Ukrainian strikes on Russian data infrastructure and whether they target additional providers beyond Yandex.
  • Follow-up reporting from Cloudflare or other researchers on social media manipulation trends in the weeks after the strikes.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe