Did Ukraine’s Strikes on Russian Data Centers Really Take Down Millions of Bots?

Written By Neil Erickson

This widely circulated graph purported to show a 56% decline in AfD-related online activity following Ukrainian drone strikes. Independent fact-checkers found that it contained inconsistent scales, future dates and no verifiable underlying data.

You may have seen the above graph on social media recently. The picture it paints is lovely, but unfortunately, very misleading.

In early October, Ukrainian drones struck three data centers operated by Yandex, Russia's largest internet technology company. The attacks disrupted cloud infrastructure, interrupted digital services and sent automated internet traffic from Yandex's networks plunging.

Within days, another story was spreading across social media: Russian propaganda bots had supposedly disappeared, exposing what some users claimed was widespread artificial support for political movements in Europe and the United States.

The claims gained millions of views. According to research firm Graphika, six widely circulated posts alone attracted 6.3 million views, with users attributing supposed declines in online activity surrounding Germany's Alternative for Germany (AfD), Britain's Reform UK and President Trump's MAGA movement to the attacks.

Ukrainian President Volodymyr Zelensky also suggested the strikes had reduced online hostility, telling an audience at the Warsaw Security Forum that there was "less hate, less division, and fewer provocations" because there were fewer bots. His office later clarified to BBC Verify that he was referring to the atmosphere on social media rather than a documented reduction in bot activity.

The military operation was real. Reuters confirmed that Yandex had suffered substantial infrastructure disruptions. The question was whether those disruptions had actually disabled Russian disinformation operations.

What the Data Actually Showed

Much of the speculation originated with a graph from Cloudflare, a company that provides security and infrastructure services for millions of websites.

On October 11, Cloudflare recorded a 99% decline in traffic from Yandex's search-engine network and a 90% decline from its cloud-hosting network, relative to normal levels.

Those numbers appeared to support the claim that Russian bots had been knocked offline. But in its October 14 investigation, Cloudflare explained that the overwhelming majority of disappearing traffic from the search network came from ordinary web crawlers, automated programs that index websites for search engines.

Of the network's requests classified as bots, 93.6% were verified as legitimate automation.

The distinction is significant. A search crawler visiting a news website and a coordinated account publishing political disinformation may both be described as bots, but they perform entirely different functions.

Cloudflare's wider data showed that automated requests accounted for approximately 39.4% of observed global internet traffic before the attacks and 39.5% on October 13. Russian-origin automated requests declined from 50.4% to 42.1% of Russia-origin requests, a noticeable change, but nowhere close to the disappearance suggested by viral headlines.

Cloudflare also identified malicious automation migrating between hosting providers after Yandex.Cloud went offline. In one sample involving gambling websites, Russian-origin automated requests increased slightly, from 167.7 million to 170.1 million, as activity shifted to alternative networks.

The evidence suggested that some operations were interrupted, while others quickly reestablished themselves elsewhere. It did not identify the operators as Kremlin propagandists.

The Political Claims Fall Apart

Researchers examining the political communities supposedly affected found little evidence of the dramatic declines described online.

Graphika analyzed activity associated with Germany's AfD and found 40,365 posts on October 11, compared with 42,040 the previous Sunday. The 4% decline was within normal weekly fluctuations.

Mentions of MAGA on X actually increased by 25% during the eight hours following the final data-center strike, compared with the corresponding periods on the previous four Sundays.

One particularly influential graphic, shared by Czech European Parliament member Tomáš Zdechovský, purported to show a 56% collapse in AfD-related activity.

But Deutsche Welle's fact-check found that the chart identified neither its data source nor its methodology. It also contained inconsistent scaling and displayed dates that had not yet occurred when the graphic was first published.

Researchers tracking known Russian influence campaigns also told BBC Verify that networks including Storm-1516 and Matryoshka continued operating after the attacks.

Some Networks Really Were Disrupted

The evidence does not suggest the strikes had no impact on suspicious online activity.

An October 15 report from Ukraine's Center for Countering Disinformation analyzed 5,201 Facebook and Telegram accounts flagged for signs of inauthentic behavior.

The researchers recorded an 83.6% decline in daily posts on October 8, shortly after the first major outage. Activity recovered within two days, exceeding pre-strike levels, before declining again by 42.6% on October 12.

These findings suggest that certain automated or coordinated networks may have experienced temporary interruptions.

However, the report examined a selected group of accounts, not all Russian influence operations. It did not independently establish that every account was Kremlin-controlled or prove that the strikes caused the changes.

Graphika separately observed posting declines of 5% to 15% in Russian-language Telegram channels, although disruptions to ordinary internet access inside Russia could also explain some of that activity.

How a False Narrative Became the Bigger Story

Researchers at the Canadian Media Ecosystem Observatory examined how claims about disappearing Russian bots spread through discussions of Alberta separatism.

They found that posts supporting the narrative received 73% of views among posts discussing the strikes in that debate, while rebuttals received just 14%. The researchers found no corresponding collapse in activity among the prominent political accounts supposedly affected.

Russian influence operations remain a documented problem, and the Ukrainian strikes caused genuine damage to important Russian infrastructure. There is also evidence that some suspicious online networks experienced short interruptions.

What the available research does not support is the much broader claim that the attacks effectively eliminated Russian propaganda or exposed Western political movements as artificially sustained by Moscow.

The original Cloudflare graph was accurate within its technical context. It measured requests from particular networks, not the political identities or intentions of the accounts operating online.

By the time that distinction was widely understood, a story built around the graph had already reached millions of people.

As wonderful as a world where social media is suddenly free of malicious bots sounds, unfortunately, we'll have to save that celebration for another day.

Related Articles

Neil Erickson
Next

Reservoir Farms Expands to Washington State, Bringing Agricultural Robotics to Yakima Valley