ANALYSIS The blow against Yandex: how much Russia’s influence machine is losing

Strikes against Yandex data centers were followed by a collapse in automated traffic observed from the company’s network — a possible temporary blow to some digital tools and workflows used within the Kremlin propaganda ecosystem. But the available data do not show how many propaganda accounts were affected, nor do they demonstrate that troll farms in the West were stopped: they indicate a technical disruption, not the disappearance of an operation that can move between platforms and providers.

A viral figure, with limitations

Between October 8 and 11, three Yandex data centers — in Sasovo, Kaluga, and Vladimir — were hit, according to reports based on company statements and information published by Reuters. The Sasovo center housed two of the three supercomputers used to develop Yandex’s AI models; the company has not confirmed whether the equipment was destroyed. Yandex reported outages, and some functions of its chatbot temporarily became unavailable.

At the same time, Cloudflare Radar showed that automated HTTP requests observed from the Yandex network fell, at one point, to around 0.4% of the peak recorded in the preceding two weeks, according to Tom’s Hardware. But the measure refers to automated traffic originating from one network — it does not identify who generated the requests, which accounts might have used them, or whether they were connected to propaganda. Cloudflare broadly defines bot traffic as non-human traffic, but it can include legitimate activities, not only malicious operations.

This is where the distinction blurred by viral headlines begins: a drop in bot traffic from Yandex’s infrastructure does not amount to “stopping Russian trolls.” It may indicate unavailable services, halted crawlers, or inaccessible servers. On its own, it is not a measure of coordinated activity on X, Instagram, Facebook, or Reddit.

Reports of a direct connection between the attacks and declining activity in certain Western political communities have not been independently confirmed in the sources consulted.

How bots “work” us

Troll farms are not necessarily a single centralized factory, with employees posting from a company’s servers. Research describes a combination of people, fake accounts, automation, distribution networks, and intermediary actors. Teams can be divided by topics and audiences, while messages are adapted to language, context, and local tensions.

The mechanism aims at more than spreading false information. Accounts can amplify polarizing messages, repeat the same themes, or simulate popular support and push the debate toward conflict. Sometimes, tactics exploit real grievances or controversial subjects; the operation does not need to convince everyone of one version of the facts to be effective. It may be enough to erode trust, crowd the conversation, and make the public believe that no common ground remains. An analysis by Maksim Markelov for The Conversation, based on millions of posts associated with the IRA, identifies messages adapted to the audience, repeated exposure, and campaigns that mimic spontaneous mobilization.

The infrastructure has several layers: people who write, tools that schedule or multiply posts, accounts that distribute the content, and social media platforms through which it can circulate. Some operations use hosting services, VPNs, or intermediaries to conceal their origin and avoid detection. But it does not follow that all these layers depend on Yandex. A team that loses access to a data center can move its activity to other services; an account posting on a Western platform does not need to be hosted by Yandex.

Moreover, influence no longer means only fake accounts and bots. Networks of pages, shell news websites, influencers, or other voices with audiences can carry messages to publics that coordinated accounts would not easily reach. Politico reported on allegations by the U.S. Department of Justice concerning Russian financing of an influencer media company, an example of the shift from easily recognizable “trolls” toward intermediaries who appear more legitimate.

This means that stopping one component matters, but it is not equivalent to disabling the entire operation.

What it may mean for YandexGPT

In the case of YandexGPT, the impact of the attacks must be separated into two areas. The first is operational: unavailable data centers can affect access to applications, cloud services, and AI functions, while the loss of computing resources can slow the development or training of models. Reuters reported that Sasovo housed two of the three supercomputers used to develop YandexGPT, but Yandex has not clarified whether they were damaged. The BBC reported that some chatbot functions were temporarily unavailable.

The second area is informational, and here an attack on servers does not, by itself, prove that the model produced propaganda or was used in a Western influence campaign. Language models can become channels through which users receive, summarize, or formulate information; their behavior, however, depends on training data, source selection, model tuning, and moderation rules. A study published in Nature in 2026 found that model responses can vary depending on the language of the prompt and the region in which they were created. The authors warn that such differences are not, by themselves, evidence of a propaganda campaign — and that “neutrality” is not a simple or universal benchmark.

Separate research into the moderation practices of several models indicated high refusal rates in the Russian models tested, including YandexGPT. The finding describes the behavior observed in those tests; it does not demonstrate that every response from the model is propagandistic, nor can it automatically be extrapolated to all Yandex versions or services.

Consequently, the attacks may affect YandexGPT’s availability and technical capacity. They do not instantly change the model’s logic and do not represent, without additional evidence, a victory over digital propaganda. That would require separate measurements: which AI services went down, for how long, which functions were affected, what responses they provided before and after, in which languages, and using which sources.

Assessing the impact

The most solidly documented effect is the disruption of Yandex’s infrastructure and of some dependent services. The 0.4% figure describes an abrupt drop in automated requests observed from the company’s network, not the number of trolls, posts, or propaganda messages eliminated.

This does not mean that infrastructure is irrelevant. An outage can temporarily stop certain automated workflows, interrupt services used for indexing or distribution, and make access to AI computing tools more difficult. But influence operations are redundant: they use different platforms and providers, and coordination can continue through people or other networks even if one technical component becomes unavailable.

The prudent assessment is therefore less spectacular than the idea that “troll farms were stopped overnight,” but more meaningful: the attacks demonstrated the vulnerability created by concentrated digital infrastructure, not the disappearance of Russian propaganda. To speak of a real reduction in influence in the West, one would have to separately verify a decline in coordinated activity on platforms, identify the origin of the accounts, and measure the circulation of narratives — not merely count automated requests from a single network.

Analysis produced with the support of Perplexity