When Data Centres Become Battlefields: How Ukrainian Strikes on Yandex Exposed Pro-Kremlin Bot Networks

Yandex is deeply embedded in Russia’s digital economy. Its services cover search, cloud computing and other online activities, making its infrastructure important to businesses and ordinary users alike. Damage to a major data centre can therefore affect far more than the systems operated directly by the company.

The reported disruption was substantial. Cloudflare recorded a fall of more than 99 per cent in automated HTTP requests and bot traffic originating from the Yandex network, leaving activity at around 0.4 per cent of the peak recorded during the previous two weeks. NetBlocks reported that Yandex Cloud traffic dropped to 30 per cent of its normal baseline, while general traffic associated with Yandex LLC fell to 63 per cent.

These measurements describe different types of traffic, and neither should be confused with a direct count of political bots. They nevertheless point to a major interruption in the company's network.

The consequences reportedly extended to cloud customers, real estate platforms and digital services used by Russian Railways and MegaFon. The damage in Sasovo may be particularly difficult to overcome because advanced computing hardware cannot simply be replaced by redirecting traffic to another server. The loss of a substantial concentration of processing capacity can leave workloads competing for the resources that remain.

For Russia, the incident raises a question of digital resilience. A domestic technology industry can reduce dependence on foreign providers, but it cannot eliminate the risks created when important services rely on a limited number of large facilities.

The political implications may prove more contentious than the commercial damage.

What disappeared from social media?

Following the strikes, observers reported a steep decline in activity among accounts associated with Russian influence operations. According to the briefing, activity supporting Germany's Alternative for Germany party fell by at least 56 per cent. Activity linked to Nigel Farage's Reform UK network approached zero. Similar changes were reported among accounts associated with Donald Trump's MAGA movement and advocates of independence for Canada's Alberta province.

The timing has encouraged the interpretation that the Yandex outages disrupted a common source of automated political amplification.

There is a plausible mechanism behind that argument. Large-scale influence campaigns require infrastructure. Accounts need to be created, maintained and coordinated; automated systems need computing resources; and operators need ways to distribute content repeatedly across platforms. If a significant part of that operation depends on facilities that suddenly become unavailable, its output could fall rapidly.

Yet the evidence presented so far does not establish that the accounts in question were hosted at the damaged data centres. Nor does a decline in posting activity prove that every affected account was controlled by Russia. Political movements can attract genuine supporters, organised campaigners and automated accounts at the same time. Their activity may overlap without sharing a single operator or technical provider.

The distinction matters because the figures measure different things. A network outage can be measured through traffic data. The origin and purpose of a political campaign require separate evidence.

Cloudflare's measurements show a dramatic change in traffic associated with Yandex. NetBlocks recorded a significant decline in the company's cloud activity. The reported changes across political accounts provide a third set of observations. Connecting them would require evidence tracing the affected accounts or their supporting systems to the infrastructure that was struck.

Without that link, the figures cannot tell us what proportion of online support for AfD, Reform UK or MAGA was artificially generated.

A problem Western governments have yet to solve

Foreign interference is hardly a new concern. In July 2024, the US Department of Justice dismantled a network of more than 1,000 AI-driven X accounts that it linked to Russian intelligence efforts to influence American political debate.

Such cases have exposed the difficulties of identifying coordinated activity on platforms where authentic political speech, automated posting and deliberately misleading content can appear side by side. Governments and technology companies have responded through investigations, content moderation, platform rules and legal action. None of these measures has removed the problem.

The reported Yandex disruption raises the possibility of approaching it from another direction. Instead of focusing only on what accounts publish, investigators could examine the infrastructure that enables coordinated activity to operate at scale.

That approach could be useful even if the latest claims prove less sweeping than some initial interpretations suggest. Mapping connections between hosting providers, cloud services and coordinated accounts would help researchers understand how influence operations are organised. It could also identify technical dependencies that remain invisible when investigators examine individual posts in isolation.

But a sudden fall in activity is not, on its own, a reliable measure of how much foreign interference has taken place. Some automated accounts may be connected to Russian operators; others may have different origins. Some genuine users may also have become less active during the disruption.

The challenge for Western intelligence agencies is to separate these categories rather than treat them as one network.

That work becomes more urgent as the US congressional midterm elections on 3 November approach. A decline in automated amplification could change the visibility of political messages online, but it would not necessarily change voter preferences. Nor could the disappearance of accounts be used as a straightforward measure of how much support a political movement enjoys among the public.

A quieter platform may offer researchers a useful comparison with earlier activity. It does not provide an unfiltered picture of public opinion.

The battlefield is expanding

The attacks on Yandex also mark a potentially important development in the war between Russia and Ukraine. Russian forces have repeatedly targeted Ukrainian energy infrastructure and communications facilities. Ukraine, meanwhile, has struck Russian oil refineries, logistics sites and other assets connected to the country's war effort.

Data centres complicate this pattern because their functions are rarely confined to a single purpose. The same infrastructure may support commercial applications, civilian communications, cloud services and systems relevant to state operations.

That overlap creates difficult questions about military targeting. A facility does not automatically become a legitimate military objective because its owner operates in Russia or because some of its network traffic may be associated with hostile political activity. The relevant issue is whether the infrastructure makes an effective contribution to military action and whether its destruction offers a definite military advantage, taking account of the applicable laws of armed conflict.

Civilian consequences also matter. The reported disruption to Yandex services illustrates how an attack on a single provider can affect businesses and users with no direct connection to the war. The greater the concentration of essential services, the wider the potential impact of damage to one facility.

There is a strategic calculation for Ukraine, too. Disrupting an adversary's infrastructure may impose costs beyond the immediate physical damage, particularly if it interrupts systems used for military or state purposes. But the longer-term value of such an operation depends on what has actually been disabled, how quickly the affected systems can recover, and whether the disruption produces a meaningful operational advantage.

The available information does not establish the full extent of the damage to Yandex's business or the time required to restore its computing capacity. Claims of lasting financial losses should therefore be treated cautiously.

Russia's digital resilience has a physical limit

Yandex's position illustrates a broader weakness in modern digital infrastructure. Services that appear distributed across the internet can still depend on concentrated computing resources. Cloud platforms offer flexibility, but moving workloads elsewhere is possible only if alternative capacity exists and the necessary systems remain accessible.

For a technology company facing physical destruction and operating within Russia's increasingly constrained international environment, replacing advanced hardware could be a difficult undertaking. The extent to which sanctions would affect a specific recovery programme is not established by the current information, but dependence on specialised equipment makes resilience a strategic concern rather than simply a question of repairing damaged buildings.

Russia also faces a contradiction. Building a powerful domestic technology sector can strengthen national control over digital services. Yet concentrating those services in a handful of major providers creates potential points of failure. The more functions depend on the same infrastructure, the more widely an outage can spread.

Western countries have their own exposure to this problem. Their cloud services and communications systems also rely on large providers, many of which support both commercial and strategically important operations. The difference lies in the circumstances and threats involved, not in the existence of the underlying dependency.

For now, the most consequential claim surrounding the Yandex strikes remains unproven: that the destruction of Russian data infrastructure directly silenced a substantial share of the automated influence activity seen across Western political networks.

If that connection can be established, the episode could give researchers a rare opportunity to trace foreign political amplification back to its technical foundations. If it cannot, the same episode will still expose a different vulnerability: the dependence of a major digital economy on infrastructure that can be disabled by a physical attack.

The two findings would have different implications for Western democracies. One would change how they understand foreign interference. The other would reinforce a more immediate lesson about the fragility of the systems on which modern political communication increasingly depends.