Ukraine wrecked Russia's best data centers and idled all three AI supercomputers. Then the internet decided that had also killed the bots. It hadn't and the way we know is a small masterclass in not believing charts.
In the second week of October 2026, Ukraine did something no one had done before: it struck data centers as a deliberate strategic target set.
Between October 8 and 11, Ukrainian long-range drones hit three of Yandex's six Russian data centers Sasovo in the Ryazan region, the 63 MW monster in Kaluga, and the Vladimir site east of Moscow. Two shut completely. The third lost several modules. Yandex Cloud went into emergency mode, its status page showed 84+ services offline at peak, and NetBlocks measured the company's cloud traffic at roughly 30% of normal. Payment apps, taxi dispatch, food delivery, retail platforms, even the door-fob systems on Moscow apartment blocks all of it runs on Yandex infrastructure, and all of it felt this.
The most consequential damage was barely reported at first. All three of Yandex's AI-training supercomputers Chervonenkis, Lyapunov and Galushkin, the machines behind YandexGPT, roughly 70 PFLOPS of AMD EPYC and Nvidia A100 compute were housed at the struck sites. All three went offline. Under sanctions, there is no quick replacement path: current estimates run from six months for routine equipment to one to two years for the training capacity. Meduza's analysis argues the strikes may set Russian AI development back years possibly behind Kazakhstan, which, in a fitting detail, hosts Yandex's own kz1 cloud region.
Then came the part that spread much further than the fires did.
The story everyone wanted to be true
Within hours of the third strike, charts began circulating. Automated "bot traffic" from Yandex's network had collapsed from a two-week peak down to 0.4%. And it wasn't just traffic. People reported quieter feeds: fewer pro-MAGA replies on X, less activity around Germany's AfD, Reform UK, even Alberta separatists. A Czech MEP, Tomáš Zdechovský, posted a chart showing AfD activity "suddenly plummeting" after the strikes. It drew four million views. Zelensky himself endorsed the thesis at the Warsaw Security Forum: "it suddenly became a little easier to breathe on many social media platforms… there were fewer bots and it's pretty clear where those bots were coming from."
The claim had everything. Real infrastructure damage, a satisfying mechanism (the bots' servers burned!), and a moral the audience already believed: that a big share of the hostility in political social media isn't people at all.
The 0.4% figure was real. The interpretation was wrong in almost every particular.
What the chart actually measured
Cloudflare Radar counts automated HTTP requests originating from a given network in this case AS13238, which is Yandex's own corporate network. Almost all of that traffic is YandexBot: the search crawler that indexes the web for Russia's largest search engine. When the data centers went dark, the crawler stopped crawling. That's the entire story of the chart. Cloudflare itself clarified the drop was "not necessarily bot behaviour on social media platforms."
A crawler fetching HTML from websites is not a sockpuppet posting replies on X. The chart could not see inside X, Reddit, Facebook or Telegram even in principle no external traffic dashboard can. And Russia-as-a-whole bot traffic, per the same source, stayed flat all week.
Mikhail Klimarev, an independent Russian internet analyst, put the mechanism plainly: Yandex's robots "essentially crawl the entire internet once a day," and the company switched them off because the compute doing the crawling had burned.
The account-level test the viral posts never ran
Two days later, the firms that actually count these accounts ran the test properly. The results are decisive.
Graphika whose live community mappings cover thousands of geopolitical networks found that none of the named communities lost active accounts or heaviest posters. AfD-related accounts published 40,365 posts from 1,022 accounts on October 11, versus 42,040 posts from 1,037 accounts a week earlier: a 4% dip, well inside a community whose week-to-week swing reaches 38%. MAGA mentions on X rose 25% in the hours after the Vladimir strike. Facebook comments on AfD politicians' posts ranged from −8% to +5%. Graphika's formal assessment: moderate confidence the strikes did not silence accounts in any named Western community.
dTeam, which tracks Moscow-linked operations, told BBC Verify there was "no traffic change from known Russian accounts and bot clusters on any platform" and demonstrated that Storm-1516 and Matryoshka, two of the best-documented Kremlin ops, kept posting straight through the strikes. Poland's state cyber institute NASK found no decline in its monitored accounts. Res Futura's ~500 tracked pro-Russian Polish-X accounts were not merely normal they were up 45% on October 13. Kate Starbird (University of Washington) charted AfD mentions hour by hour across the whole window: no dip, just the ordinary daily rhythm.
And the viral evidence? It collapsed in public
The "56% AfD drop" chart the one with four million views traces back to a Threads post. When a University of Regensburg researcher asked the original poster for the source, he was blocked. Later, pressed, the author explained the provenance: "gut feeling." The chart names no source, no platform, no metric, and its timeline runs to dates after it was posted. It is believed to be AI-generated. Polish analyst Jarosław Wolski, whose recaption of it drew 1.4 million views, deleted his post and apologised on October 13. Zdechovský admitted he hadn't verified it.
The Reddit "80% collapse" shared by a Polymarket account came from a study the author himself retracted, revealing it was produced with ChatGPT, and whose own conclusion was "no ranked community is a timing-stable result." The r/irishpolitics "−80%" was a 12-hour window that, shifted by a few hours, becomes a 109% increase. A result that flips direction when you move the comparison window is not evidence of anything.
Even Zelensky's office walked it back: the president had been "talking about the atmosphere on social media," not bot counts.
What did actually move
Honesty requires noting the two real signals neither of which matches the story.
The automated "Pravda" article-flooding network lost about half its output for roughly 13 hours after the Vladimir strike, then routed around it and recovered. Ukraine's own Center for Countering Disinformation confirmed the same pattern for Pravda, InfoDefense and "Nod of Time." That's an automated web pipeline with some dependency on Yandex infrastructure a 13-hour blip, not a silencing, and it's the closest thing to genuine evidence in the entire episode.
And Russian-language Telegram channels posted 5–15% less for two days after the third strike, with r/askarussian down after all three. Plausibly just Russia's degraded internet. Nobody can attribute it.
Why the strikes could never have done what people hoped
Here's the structural fact that makes the whole story impossible as told: since 2022, the platforms have blocked direct traffic from Russian corporate data centers. So influence operations run on purpose-built infrastructure that isn't in Russia residential proxies, compromised devices, commercial engagement-for-hire amplification networks, Western cloud providers, and human operators in third countries like North Macedonia and the Philippines. As Clemson's Darren Linvill put it, outsourcing these services has become "cheaper and easier, but also more secure and decentralized."
The bots were never on the burning servers. That's not a coincidence it's the design.
The part worth taking seriously
Strip away the myth and the real story is bigger anyway. This was the first time data centers entered a war as a deliberate reciprocal target set Russia hit at least eight Ukrainian DC operators in September and October; Ukraine mirrored, then kept going: a Sberbank data center in Saratov on October 14, and the already-dead Vladimir site hit again on October 16. NATO has confirmed data centers are now factored into its own target-vulnerability planning. Yandex pre-emptively wrote drone strikes into its force majeure clause between the second and third strikes and the Russian state is now discussing compensation for users, protection measures with the Defense Ministry, and (per the August seizure decree) holds explicit leverage over operators judged poorly protected.
The strikes genuinely hurt: ~115 MW of capacity across the Yandex sites, 84+ services down, an AI program set back years, all for roughly $55,000 per drone. That's the story. It didn't need a myth attached and the myth, once debunked, made the real story easier for skeptics to dismiss.
The analyst's takeaway
Three things worth keeping, next time a chart "proves" something too good:
- A traffic chart measures traffic. Automated requests from network X are a statement about network X not about accounts on platforms that don't route through it. Cloudflare's own methodology note said this. Nobody read it.
- Unsourced charts with clean narratives are content, not evidence. The most-shared artifact of this entire episode had no source, no platform, no method, and plotted dates after its own posting. It survived four million views because it felt confirmed.
- Correlation plus motivated reasoning equals viral. Researchers have literally measured that people rate accounts they disagree with as more bot-like — regardless of whether they're bots. "Your opponents aren't real" is a comfortable belief, which is precisely why influence operations exploit it. A false story that flatters its audience spreads faster than a true one that doesn't.
The Yandex strikes were real and devastating. The off-switch was a crawler, a gut feeling, and a crowd that wanted to believe.
Evidence base: Graphika's account-level analysis (Oct 13), BBC Verify, Snopes, the Kyiv Independent, Provereno.Media, the America 2.0 running tracker, ppc.land's Cloudflare audit, plus primary reporting from Meduza, The Moscow Times, FACTUM.PRESS and Carnegie Endowment analysis on the sovereign-internet angle. Full sourced report with figures available below.