Do Son 
Ukrainian President Volodymyr Zelenskyy recently claimed that precision drone strikes against Russian data center infrastructure severely degraded hostile automated tools. Specifically, official statements asserted that malicious propaganda bots suffered a dramatic decline in online activity. However, independent network observations contradict these assertions. Instead, telemetry demonstrates that automated tooling swiftly migrated to alternative cloud infrastructure, maintaining operational continuity.
Cloudflare Telemetry Documents Yandex Outage
Internet infrastructure provider Cloudflare published an analysis of the Yandex outage detailing the tangible impact of the infrastructure strikes. Most notably, Yandex search indexing services absorbed the brunt of the immediate disruption. Consequently, search crawler activity plummeted across monitored web properties.
On October 11, network traffic from the YandexBot crawler collapsed by 99% compared to baseline volumes. Nevertheless, telemetry indicated a steady recovery within three days. Currently, crawler traffic has returned to approximately 85% of previous operational levels. This volume primarily encompasses web page harvesting, image cataloging, and news indexing.
Automated Scanners Migrate to Alternative Russian Clouds
Furthermore, Cloudflare observed marked shifts across unverified automated request streams. Following the physical damage, bot traffic originating from autonomous system AS200350 within Yandex Cloud fell by 40%. Additionally, probing attempts targeting WordPress plugin vulnerabilities dropped by 90%. Broad-spectrum vulnerability scanning across assorted web services also declined by 93%.
Fingerprint Tracking Confirms Fast Reallocation
However, forensic network telemetry revealed that threat actors did not abandon their operations. Instead, requests exhibiting identical TLS fingerprints, target paths, and User-Agent headers quickly surfaced elsewhere. Attackers systematically transferred workloads from Yandex Cloud to alternative Russian hosting providers. Consequently, malicious automation resumed steady execution with minimal permanent disruption.
Distinguishing Infrastructure Bots from Social Media Disinformation
Importantly, observers must distinguish between automated HTTP traffic and social media influence networks. Cloudflare primarily monitors HTTP requests generated by crawlers, automated exploit scripts, and reconnaissance scanners. Therefore, these metrics do not directly quantify social media bot accounts.
Globally, the overall ratio of automated web requests remained remarkably stable throughout the incident. In addition, API traffic governing social media publishing, commenting, and engagement showed no perceptible decline. Independent network analysts similarly recorded no meaningful disruption in posting frequency from Russian accounts. Ultimately, relocating automated social media clusters requires negligible computational overhead, making such networks exceptionally resilient against physical infrastructure strikes.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
