The Russian Bots Went Silent. Or Did They?

A viral story has been circulating on social media over the past few days: Ukrainian drone strikes on Russian technology company Yandex’s data centers knocked out large numbers of Russian propaganda bots. The theory was boosted by prominent politicians—Ukrainian President Volodymyr Zelensky, for example—and picked up by prominent liberal commentators. Some have made the claim that pro-Trump MAGA accounts and accounts promoting Germany's far-right Alternative für Deutschland (AfD) have suddenly gone quiet. There have been a lot of anecdotal reports of a vibe shift—social media is so much more pleasant, some say, with fewer hostile replies and suspicious accounts.

There is a real event underpinning the story, and an authentic chart showing a dramatic decline in automated internet traffic. But the leap from a viral chart to the disappearance of Russian propaganda bots is a large one. Much of the apparent corroboration comes from anecdotes about how social media feels, rather than measurements of what actually changed. And this speaks to a broader problem: as platforms have reduced access to data, and as “disinformation” has become a politically contentious term, the ability to investigate claims about online manipulation has decreased. 

Let’s dig into what we know, and why people may be reacting as they are.

1. What happened, and why does everyone think the Russian bots disappeared?

Between Oct. 8 and 11, Ukrainian drones struck three Yandex data centers in Russia, in Sasovo, Kaluga, and Vladimir. The attacks disrupted Yandex services and affected Russian businesses that depended on its infrastructure. Reuters reported the strikes, and the Kremlin acknowledged the resulting service problems.

Cloudflare's measurements documented the disruption in real time. Following the first strike, traffic from Yandex Cloud's network (AS200350) fell approximately 33 percent below normal beginning at 22:30 UTC on Oct. 7. Traffic from Yandex's main network (AS13238) also declined, falling roughly 25 percent below its earlier baseline on Oct. 8 and 35 percent on Oct. 9–10, according to one analysis of Cloudflare data.

By 2 a.m. UTC on Oct. 11, there was evidence of a dramatic collapse: automated HTTP requests from AS13238 had fallen to just 0.3 percent of the chart's recent maximum, compared with 88.2 percent at the same hour a week earlier. This is a decline of more than 99 percent relative to the comparable hour. 

That's an enormous drop in automated traffic; the surprising chart was shared online by members of the public, along with visuals of a burning data center. Yet the broader viral story hinges on what, exactly, Cloudflare’s chart means by a “bot”—and whether it's the same thing people mean when they complain about “Russian bots” on social media.

2. Wait, what exactly is a "bot"?

“Bot” is shorthand for an automated entity that performs tasks online. This can mean many different things depending on who is using the term. Search engines such as Google and Yandex deploy web crawlers—often called bots—to visit websites and index their content; Google sends Googlebot to scan news websites for example, so that their articles can appear in search results. Cloudflare tracks this kind of traffic. 

Social media bots, meanwhile, are accounts that automatically post, reply, or amplify content. On social media, the term “bot” is used much more loosely. Some accounts are automated, and automatically post or amplify content. Some combine human operators with automated activities, and “bot” stands in for “troll”. When people complain about "Russian bots" in their replies, they're often using the term to describe accounts they suspect are fake or inauthentic, regardless of whether they're actually automated. And sometimes they're just insulting someone they disagree with.

3. So what does the Cloudflare chart actually show?

Cloudflare operates infrastructure that handles traffic for millions of websites. Its Radar product publishes aggregate information about the requests passing through that infrastructure. The viral chart, which is authentic, shows crawler traffic tanking following the bombings. It specifically documents automated HTTP requests from AS13238, an autonomous system associated with Yandex. (An autonomous system is essentially a collection of internet networks operated under a common routing policy.) Yandex crawlers routinely visit websites to index their content.

What Cloudflare is measuring in that chart are automated requests to websites served by Cloudflare, not the number of accounts posting political content on X, Facebook, or Reddit. These aren't two categories of activity within the same dataset: they are fundamentally different things being measured. A web crawler indexing a website and a troll account posting political content on X may both be colloquially called "bots," but the Cloudflare chart does not tell us how many of the latter are active, or suggest anything about how Yandex may have impacted them. 

4. But couldn't the strikes also have disrupted Russian propaganda operations?

Possibly. But the evidence currently doesn't establish that they did. 

The viral claim alleges that Russian propaganda accounts were operating via the Yandex infrastructure that was disrupted. But there's no evidence connecting the traffic decline to altered activity on social media. 

Russian influence operations are not necessarily run from identifiable Russian servers. Operators can use commercial hosting, VPNs, proxies, and infrastructure in other countries to obscure where they are operating. Sophisticated influence operators, such as those behind persistent Russia-linked campaigns such as Matryoshka, have incentives to conceal their infrastructure and origins. There is no reason to assume their activity would be visible in traffic originating from Yandex's network.

So although Yandex infrastructure was disrupted, we still need independent evidence connecting that infrastructure to particular influence operations—and evidence that those operations actually experienced a decline in activity. Instead, we’re seeing what looks like the opposite. I reached out to University of Washington Center for an Informed Public social media researcher Kate Starbird yesterday to ask what she was seeing in where AfD was concerned, since that had been an anecdotal example of purported decreased commenter activity. She took a quick look and sent over the following charts.

The chart shows no obvious collapse in AfD-related conversation during the period in question. Mentions continued to rise and fall in a familiar daily pattern, including after the reported Yandex disruptions. Across the full period measured, there were approximately 946,000 mentions, a 51.6 percent increase over a preceding comparison period. There is no visible cliff in the conversation corresponding to the dramatic drop in Yandex traffic.

This is a preliminary look at aggregate activity on a specific topic, not a study of accounts attributed to Russian influence operations. It cannot rule out disruptions to particular influence networks. But it does not support the sweeping claim that AfD-related activity suddenly went quiet. Graphika released a comprehensive analysis showing no discernible drop on the topics users alleged had gone quiet; it did note decreased participation in Russian Telegram channels (possibly caused by internet outages). Other researchers have debunked claims about mentions of Palestine.

5. Why did so many people believe the claims?

Because it's a satisfying narrative, and one that seems to explain an experience many social media users already have: the feeling that online conversations are crowded with suspicious accounts, coordinated harassment, and “people” who may not be human at all.

It also has the ingredients of a viral story. There's a dramatic military action, a striking graph (evidence!), a familiar villain, and a happy ending. Ukraine hits Russian infrastructure; Russian trolls disappear; the internet becomes a friendlier place.

Technical analyst reports were skeptical from the start, though those can be harder to understand than the broad-stroke story in news headlines, or trends on social media. And when prominent accounts begin sharing anecdotes about quieter replies or less harassment, plausible speculation starts to seem like corroborated fact.

So, ironically, a story about the disappearance of Russian propaganda bots became a viral misleading story on its own. 

6. Couldn’t disinformation researchers just check whether accounts stopped posting?

In principle, yes. Researchers could look at posting volumes before and after the strikes, count how many accounts were active, and compare changes in conversations about MAGA or the AfD (see above) against other political topics. They could also examine previously identified Russian influence networks to see whether particular accounts stopped posting.

But even a measurable decline would not necessarily establish that the affected accounts were Russian, automated, or connected to Yandex. Political conversations fluctuate for many reasons, including news cycles, weekends, and platform algorithms. Researchers would need baselines and comparison groups to determine whether anything unusual actually happened. Platforms would have the best visibility into these dynamics, but may be reluctant to weigh in.

Which speaks to a more basic problem: conducting this kind of systematic analysis has become considerably harder than it used to be.

7. Why is it so hard to answer these questions now?

Crowdtangle and Twitter’s firehose were not magical instruments for identifying Russian operatives. At Stanford Internet Observatory we discovered and investigated many foreign influence campaigns over five years. But attributing accounts to particular operators—Russian, Chinese, Iranian, or otherwise—was generally a collective undertaking. Researchers could observe public account behavior spanning social platforms. Individual platforms had internal telemetry, including information about account creation, login patterns, and technical infrastructure. Governments sometimes had evidence from intelligence or law enforcement investigations. Each could see pieces of a larger picture.

Unfortunately, even basic information-sharing among researchers, platforms, and governments was subsequently recast as a “censorship” conspiracy. Meanwhile, platforms restricted access to data and sunset research tools.

The combination of diminished access to tools and the political demonization of disinformation research has made investigations harder, more expensive, and more difficult to reproduce. That's a significant public-accountability and awareness problem.

8. What does this all tell us about the state of the information environment? 

The Yandex story is appealing because it confirms something many people already suspect: that much of what they encounter online is fake or manipulative. It’s also comforting to believe that one’s noisiest or most aggressive political opponents aren’t even real. The Ukrainian drone story offers the poetic justice of seeing a bad actor get its comeuppance: Ukrainian drones hit Russian infrastructure, and suddenly the internet becomes a nicer place. 

It's a great story. But it looks like fiction rather than fact.