War has always had a digital shadow, and in the ongoing conflict in Ukraine, that shadow is written in the language of data centers, server racks, and automated bots. When Ukrainian forces carried out strikes on some of Yandex’s largest data centers, it felt like a significant turning point. For a brief moment, the numbers seemed to reflect a genuine setback for Russian online infrastructure: bot traffic originating from Russia appeared to be slowing down, and there was a sense that perhaps these physical blows had dealt real damage to the machinery of disinformation and cyberattacks. But as with so many things in the modern digital age, appearances turned out to be deceiving. Cloudflare, one of the world’s largest internet infrastructure companies, has since published an analysis that tells a far more complicated story. The slowdown was real, but it was also temporary and, in many ways, superficial. The attacks disrupted some of the most important physical infrastructure that Russian internet services rely on, and traffic levels on major platforms like Yandex Search and Yandex.Cloud did drop dramatically. Yet the digital ecosystems those platforms supported were not simply destroyed. They were displaced. What initially looked like a victory against Russian bot networks turned into a sobering lesson in the resilience, adaptability, and portability of cloud-based operations. In the weeks following the strikes, Cloudflare observed that while activity on Yandex’s own networks had fallen off significantly, the same harmful behaviors that had been running through those networks were showing up elsewhere, often within hours, as though the entire operation had simply picked up and moved to a new address. The story is not one of easy triumph, but of a persistent, adaptive adversary that has learned to treat physical infrastructure as interchangeable, and that view is reshaping how analysts understand the battle against automated online threats.
The data from Cloudflare paints a nuanced picture of what actually happened in the aftermath of the strikes. Overall traffic on Yandex Search and Yandex.Cloud remained at just 10 to 15 percent of normal levels, indicating that the disruption to the network was real and ongoing. But when Cloudflare dug deeper into the nature of that traffic, something interesting emerged. The traffic on Yandex Search was made up largely of verified search crawlers, the kinds of automated programs that index websites so they can appear in search results. In other words, most of what was still running on that service was legitimate, ordinary internet plumbing rather than malicious activity. On the other hand, Yandex.Cloud, which had been a major source of hostile bot traffic, saw a clear drop in malicious behaviors such as vulnerability scanning and probing after the data center bombings. That sounds like good news, but it came with a major caveat. Cloudflare noted that while high-volume automation did decline on Yandex’s own infrastructure, it did not vanish from the internet altogether. Instead, it simply migrated to other hosting providers. Specifically, the company observed that malicious bots were transferring to other autonomous system numbers, or ASNs, in Russia, including hosting providers like Radist and Selectel. This pattern is a familiar one in the cybersecurity world: when one route into a network is blocked or destroyed, the operators behind the activity simply find another path. The underlying bot networks, the command structures, and the malicious intentions were all still alive; they had just changed where they lived. For anyone hoping that physical strikes on data centers would deliver a lasting blow to Russian cyber capabilities, this was a sobering reality check. The machines may have stopped running in one location, but the work they were doing quietly resumed elsewhere.
A single concrete example from Cloudflare’s analysis illustrates just how seamlessly this migration occurred. One of Cloudflare’s customers in the gambling sector had been suffering from a steady stream of malicious bot requests that were coming from Yandex.Cloud. After the Ukrainian strikes on Yandex’s data centers, those requests dropped to zero. It looked, at least on paper, like the problem had been solved. But that relief was short-lived. Almost immediately, the same customer began seeing the exact same kind of malicious bot activity being routed through other networks. The attackers had not given up; they had simply relocated their operations. The broader numbers confirm this pattern. Over the course of the week in question, Russian bot traffic targeting gambling accounts remained essentially flat, moving from 167.7 million requests to 170.1 million requests, an increase of 1.4 percent. In other words, despite the loss of a major cloud platform and the physical destruction that caused it, the automated assault on the gambling industry did not slow down in any meaningful way. It actually grew slightly. As Cloudflare put it, the automation never stopped running; the operators simply migrated their workloads to alternate cloud providers once Yandex.Cloud became unavailable. This is a crucial insight for anyone trying to understand the nature of modern cyber conflict. The bots are not tied to any particular server or data center. They are programs that can be copied, moved, and redeployed with relative ease. When one hosting provider becomes too dangerous or inconvenient to use, there is almost always another one available, often in the same country and sometimes even on the same continent. The physical infrastructure matters, but it is not the heart of the operation. The heart is the code, the coordination, and the people behind it, and those things are far harder to destroy with bombs.
Cloudflare also extended its analysis to social media traffic, and the findings there were just as sobering. In the same period, traffic from Russian-origin IP addresses only dropped by 0.6 percent. That is a remarkably small decline given that a major chunk of Russian cloud infrastructure had just been bombed. Even more tellingly, Russian bot traffic that was specifically targeting “post,” “reply,” and “like” actions on one social media platform decreased by only 5.7 percent. Again, the drop is so small that it is almost negligible in the broader context of a coordinated campaign to manipulate public discourse online. This led Cloudflare to directly challenge the theory that the Ukrainian strikes had caused a significant drop in social media manipulation. The idea that destroying a few data centers could meaningfully reduce the volume of Russian disinformation on social media, or curb the automated armies that amplify it, simply did not hold up under scrutiny. Even if some individual bots disappeared or were temporarily disrupted, the overall machinery of social media manipulation remained fully functional. There is an important caveat to this, however. Cloudflare’s analysis is limited to traffic that passed through its own services. It is not a complete picture of everything happening on the internet. There may be bot traffic that flows outside Cloudflare’s visibility, and there may be effects of the strikes that are not captured in the data. Still, the pattern is clear, and it is consistent with what the company found in the gambling sector and elsewhere. The physical disruption caused by the strikes was real, but its impact on the actual behavior of malicious actors was minimal. The bots kept posting, kept replying, kept liking, and kept pushing their messages out into the world, just as they had before the bombs fell. If anything, the strikes demonstrated how difficult it is to disrupt an adversary that has already built its operations to be portable and resilient.
The broader lesson here extends far beyond the specific case of Yandex and the war in Ukraine. Cloud-based workloads, by their very nature, are designed to be transferable. A website, a database, a bot fleet, or any other digital service can be moved from one data center to another with surprising ease, often with little or no downtime. This is a feature of modern cloud computing, not a bug. Companies intentionally build their systems to be portable so that they can scale up, switch providers, or recover from outages. But that same portability applies to malicious actors. When a data center is destroyed, the services running on it do not necessarily die. They can be migrated, sometimes automatically, to another facility in another location. Cloudflare pointed out that this is exactly what happened in a different geopolitical conflict: when Iranian strikes affected AWS data centers in Bahrain and Abu Dhabi, Amazon advised its clients who had been impacted to move their workloads to other available infrastructure. The advice was practical, straightforward, and strikingly common sensical: if your digital operations are disrupted, relocate them. That advice works just as well for a legitimate business as it does for a hostile bot operator. This reality makes physical strikes on data centers a useful but limited tool in modern conflict. They can cause disruption, inconvenience, and temporary outages. They can force adversaries to spend time and money finding new hosting arrangements. They can even provide a short-term reprieve for the targets of cyberattacks. But they cannot deliver a permanent knockout blow to an operation that is designed to be mobile. As long as there are data centers available, and as long as those data centers are willing or able to host a given workload, the bots will find a place to run.
Ultimately, this is why defending against automated threats like bot networks is so difficult. It is not simply a matter of blocking an IP prefix or taking down a known server. Even destroying the physical infrastructure behind those threats, as powerful as that action might seem, is not enough to stop them. Cloudflare’s analysis makes it painfully clear that when one door closes, another one opens. Operators of bot networks can move their operations to a different provider in a matter of hours, and once they do, they can quickly return to their previous levels of activity. This creates a kind of endless whack-a-mole dynamic in which defenders are always chasing the latest IP addresses, the latest hosting providers, and the latest techniques, only to see adversaries slip away and reappear somewhere else. The fight against malicious automation is therefore not about a single decisive victory. It is about constant vigilance, constant adaptation, and a willingness to look beyond the surface-level numbers. The fact that traffic from one Russian platform dropped might feel like progress, but it means very little if the same traffic is simply coming from somewhere else. Humanizing this struggle means understanding that behind every bot, every request, and every automated attack, there are people making decisions, adapting to circumstances, and finding new ways to achieve their goals. The infrastructure may be made of steel and silicon, but the conflict is deeply human. And as long as that remains true, the bots will keep running, the traffic will keep flowing, and the challenge of defending against automated threats will keep evolving. The strikes on Yandex’s data centers were a bold move, and they did cause real disruption, but they did not end the war in the digital shadows. They simply changed its geography.