Three Drones Took Yandex's Data Centres Offline. The Bots Moved to a Different Building.

The claim swept. "They're eating the drones. They're eating the bots. They're eating the data centers of the disinformation folks who live here." It was the top comment under a Reddit thread that passed eighty-five thousand upvotes, and the short version of it was that Ukrainian drone strikes had decapitated Russian bot operations by cutting off the servers they ran on.

The infrastructure part was real. The conclusion was not.

Cloudflare sits in front of a large share of Russian internet traffic, and on 14 October it published the network data. The finding was not that the bots stopped. It was that they moved.

What was actually struck#

Three Yandex facilities went down in four days. The first was Sasovo, in the Ryazan region, on the night of 7 to 8 October. Yandex's own statement said the data centre there was "seriously damaged" and that "another of our data centers, in Kaluga, was attacked" the following morning, 9 October. The third was in the Vladimir region overnight on 10 to 11 October, and that one produced the most quotable line in the whole episode.

The company's status page, incident 2136, is the primary record. It says the infrastructure of the Vladimir data centre was damaged, that "the data center's operation has been completely suspended," and that there were no casualties there. At Kaluga the regional governor reported nine people injured.

The draft dates in the initial briefing were off by one day for the first two strikes, and the pairing of a weekday name with a date it cannot belong to is a small signal about how fast the story was being assembled. Yandex Cloud moved two availability zones, ru-central1-a and ru-central1-b, into what it called emergency mode. NetBlocks put connectivity at about thirty percent of normal on 11 October. The company asked users to activate disaster recovery plans.

Kyiv's stated rationale was money. BBC reported that Kyiv was "targeting places that provide revenue streams for Moscow's war machine," with the aim of forcing Russia to divert resources to repair. Ukraine rarely claims such operations. Yandex did not name an actor. Fire Point has claimed responsibility for the FP-1 drones.

The number that made the rounds#

Ninety-nine percent. On 11 October, Cloudflare measured traffic from AS13238, the ASN carrying Yandex Search, at 99 percent below baseline. The same measurement for AS200350, Yandex.Cloud, came in at 90 percent.

A figure of 94 percent also circulates. It comes from Valdrans, which analysed hourly Cloudflare Radar data for the same ASN against a 14 to 30 September average, and published the method and the baseline. The attribution therefore belongs to Valdrans, not to Cloudflare, and not to Volodymyr Zelenskyy, who said in Warsaw on 12 October that there were "fewer bots" and "less hate, less division, and fewer provocations" without giving a figure. Some social posts attributed the number to him anyway.

The separate claim about pro-Russian accounts came from Ukraine's Center for Countering Disinformation, and it is the more interesting number because it is a measurement of human behaviour rather than of packets. CPD sampled 5,201 accounts flagged as inauthentic by the Osavul detector across 26 topics between 6 and 12 October, and reported messages falling from 4,032 to 660 on 8 October, an 83.6 percent drop, with active accounts down 83.1 percent. Telegram fell 90 percent, Facebook 79.5 percent.

Two things about that number matter. It describes the Ukrainian information space, not a global pro-Russian network, and it describes one day. CPD's own conclusion is that the effect was "substantial but short-lived." Activity fully recovered by 10 to 11 October, exceeding the pre-strike level, and then fell a further 42.6 percent on 12 October after the Vladimir shutdown.

What Cloudflare actually saw#

The Cloudflare post is worth reading as a piece of measurement rather than a piece of commentary, because the gap between the two is where the story got lost.

For Yandex Search's ASN on 11 October, traffic fell 99 percent below baseline. For Yandex.Cloud's ASN, 90 percent. Bot traffic from Yandex Cloud fell by roughly 40 percent. Russia-origin bot requests fell roughly in proportion, from 50.4 percent down to around 42 percent.

Then the breakdown, which is where the headline becomes misleading. Cloudflare found 78.1 percent of the bot requests on the Yandex Search network were verified search crawlers, and 93.6 percent of that ASN's bot requests overall were verified. The verified crawler traffic went away and came back, because a search index that is not being crawled stops being worth maintaining. That single number accounts for most of the 99 percent.

The small malicious remainder behaved completely differently. Gambling-targeted Russian bot traffic, the clearest signature of a commercial bot farm operating from Russian hosting, went from 167.7 million requests to 170.1 million, an increase of 1.4 percent. The traffic that reappeared came from Radist and Selectel, and it was recognisable: identical JA4 fingerprints, identical request paths, identical headers, identical user agents.

JA4 fingerprints are worth a sentence, because they are the reason "migrated" is a stronger word than "reappeared". A JA4 fingerprint is a passively derived signature of a TLS client, computed from the shape of its handshake. Automation that wants to look like a browser cannot change it without changing its TLS stack. Two hosts serving the same fingerprint, with the same paths and the same headers, are the same operator.

The social-media endpoints told a flat story too. Russian-origin post, reply and like traffic was down 5.7 percent, while global traffic to those same endpoints rose 1.1 percent. No unexpected shift, which is what a physical cause would produce and a content-policy cause would not.

Why the bots did not stop#

Cloudflare's post is not ambiguous about it.

Gambling-targeted Russian bot traffic from the affected network did not fall. It went from 167.7 million requests to 170.1 million, an increase of 1.4 percent. The traffic that reappeared came from Radist and Selectel, and it was recognisable: identical JA4 fingerprints, identical request paths, identical headers, identical user agents. Renée DiResta's read in Lawfare, drawing on Kate Starbird's network data and Graphika's account-level analysis, found the same thing. Malicious automation migrated instead of stopping.

The social-media endpoints told a flat story too. Russian-origin post, reply and like traffic was down 5.7 percent, while global traffic to those endpoints rose 1.1 percent. No unexpected shift. Cloudflare's closing line is the whole finding: physical infrastructure is static, but malicious automation is built to move.

The reason the headline number looks so much bigger than the operational one is that the ASN in question was mostly not doing anything interesting. Cloudflare's breakdown found 78.1 percent of the bot requests on that network were verified Yandex search crawlers, and 93.6 percent of the ASN's bot requests were verified. The verified crawler traffic collapsed and came back. The small malicious remainder was already elsewhere within hours.

What the civilian record actually shows#

If you want the part of this story with the strongest documentation, it is not about bots at all.

On the Russian side, Yandex is not only a search engine. It runs a payments business, a taxi app, a food delivery app, smart home devices with digital keys for apartment doors, and the cloud platform that hosts Russian court hearings and government systems. Rosselkhoznadzor moved VetIS, the veterinary certificate system, and Saturn, the pesticide traceability system, into emergency mode from 06:00 on 11 October, attributing it to a power cut in the Vladimir region. Dozens of Russian court hearings were disrupted. Some Kaluga region government websites went offline. Two substations were destroyed near Vladimir, leaving roughly 5,000 residents without power.

The payments outage produced the most human quotes of the week. NBC interviewed Russians locked out of Yandex Pay savings for four days. One had no access to money for rent, utilities or food. Yandex's fintech head apologised publicly: "I'm very sorry I can't tell you yet that everything is working again, I understand how hard it is to wait when you can't use it."

The other half of the campaign is less discussed and better sourced. Russia's Ministry of Defence named New-Telco, United DC, Kyivstar and Parkovyi as targets. About 100,000 households in the Kyiv region lost internet, according to Ukraine's Digital Transformation Ministry. Four people were killed at the Datagroup office on 25 September, and two children and an adult were wounded in separate strikes. MiroHost's Kyiv data centre was destroyed. Parkovyi, Ukraine's only Uptime-certified Tier III facility, was described as suffering critical damage with restoration of services at that site impossible, and customer data moved to EU backups. Ukraine allocated 518.3 million hryvnia, about 12.5 million dollars, for backup IT.

Both sides, and the asymmetry#

The dossier this post is built on flagged the balance problem, and it is a real one. Russia struck Ukrainian data centres too, and that half is less documented.

Since 23 September, Russia's Ministry of Defence named New-Telco, United DC, Kyivstar and Parkovyi as targets. Meduza counted data centres of at least eight Ukrainian companies damaged or destroyed in that window. MiroHost's Kyiv facility was destroyed. CityHost's equipment was destroyed. UTELS's core equipment was damaged and left without power. The Crazy Network traffic exchange was damaged. Ukraine allocated 518.3 million hryvnia for backup IT, roughly 12.5 million dollars, and the data at Parkovyi, Ukraine's only Uptime-certified Tier III facility, was moved to EU backups. For that facility, DCD reported restoration of services at that site is impossible.

A post that only tells the Ukraine side is a propaganda post, and the same mechanism applies to both. The physical stack is what it is. What differs is who has the intelligence picture to target it and who has the cloud capacity to move the workload afterwards, and that is not a moral asymmetry so much as a capability one.

There is also a third side to the same infrastructure on the Russian end that is worth naming explicitly. Yandex Cloud is not a neutral cloud in this period, it is a host, and the same facilities that went dark were carrying Russian government workloads, including the systems Rosselkhoznadzor moved to emergency mode, and the cloud platform hosting Russian court hearings. A strike on a building that is simultaneously a consumer payments app, a cloud provider, a tax system and a court system does not have a single victim class.

What this does and does not establish#

The durable structural point is not that drones are good at hitting servers. It is that the location of servers for an information operation is chosen by procurement, not by whoever operates the network. Somebody signed the power contract and somebody signed the lease. There is a physical address, and it can be found.

The countermeasure that demonstrably worked was not content moderation, platform policy or sanctions on an operator. It was a munition. That is a genuinely new fact about the information environment, and it cuts both ways, because physical defence is available to any state with drones and a target list.

But the effect measured so far is displacement. And the reversibility problem is not small. The same infrastructure carrying the bots also carries a food delivery app, a taxi app, a payments system, digital keys to people's homes, veterinary certificates, and the cloud platform hosting the courts. Yandex's own framing, that it is "very difficult to say" when the equipment will be running again, is the right one. Ukraine's logic depends on the repair taking longer than the political moment. On 11 October, for Russian users, it did not.

What the data does not establish is that data centres are now a standard military target. One company is not a doctrine. US and European officials have repeatedly declined to attribute subsea cable and data centre incidents to Russia and China, and in several cases concluded that Baltic incidents were accidental. Both sides struck data centres in this period, and that symmetry is the pattern worth naming rather than the novelty.

And the live layer, which is usually the first thing to reach for and the last thing to trust, points the same way. The thread that produced the eighty-five thousand upvotes was titled around bots being nearly eliminated. The thread that a Cloudflare engineer answered drew the most technically substantive discussion. Engagement measures attention, not accuracy, and this week the two were pointing in opposite directions.

The claim was that the war had reached the servers and killed the bots. The servers were hit. The bots were already somewhere else, and they had brought their fingerprints with them.

There is a version of this story that does not need the bots at all, and it is better supported. In the same week that three data centres went dark on one side of a front line, the other side lost about 100,000 households to internet outages, had four people killed in an office building that hosted telecommunications gear, and permanently lost the only facility in the country that could claim a Uptime-certified Tier III rating. Cloudflare's finding was that moving is cheap. The finding that survived scrutiny on the other side of the line was that some of this infrastructure cannot be moved, because it is a building, and the building is in a country that is at war.

That is the durable fact. A bot network can migrate to a different host in an afternoon. A Tier III data centre cannot migrate out of a damaged building, and the money and the permits and the five-year queue positions that went into it do not come back either.