In the early days of October, a string of Ukrainian drone strikes against Yandex data centers inside Russia seemed to offer a tantalizing glimpse of a new kind of warfare. Between 8 and 11 October, drones hit Yandex facilities in Sasovo and Vladimir, while Ukrainian drone maker Fire Point claimed its FP-1 drones struck a site in Kaluga in between. The attacks were bold, dramatic, and aimed squarely at the digital backbone of Russia’s largest technology company. Then came the political claim that made these strikes feel even more significant. At the Warsaw Security Forum, Ukrainian President Volodymyr Zelenskyy told an audience of Western officials and security experts that once Ukraine’s response reached Yandex, social media had noticeably fewer bots. The idea was simple and powerful: if you knock out the server farms that host disinformation infrastructure, you might also silence the automated accounts that spread lies across the internet. Lithuania’s prime minister quickly picked up on the idea, suggesting that Ukraine’s allies should encourage more strikes on Russian data centers in order to protect European elections from foreign interference. It was the kind of story that feels right in the age of hybrid warfare—a physical attack on digital enemies, a clear cause and effect, a clever way to defend democracy without sending troops. But when Ukrainian disinformation-monitoring company LetsData actually checked the networks it follows, that neat story began to fall apart. Co-founder Ksenia Iliuk told Euromaidan Press on 13 October that the bot networks LetsData tracks showed no meaningful change after the strikes. The claim that Yandex attacks thinned out social media bots found no support in the data the company could see. She was careful not to rule out broader effects, but the evidence simply was not there.
What LetsData did was not a casual glance at trending topics. The company’s analysts went looking for the specific kinds of coordinated accounts that usually stand out clearly on platforms like X and Facebook. These are not random trolls leaving angry comments; they are organized networks, often linked to Russia’s broader influence ecosystem, that work on schedules, follow scripts, and push narratives across multiple countries and languages. Among the networks LetsData examined were groups of X accounts spreading domains associated with what Iliuk described as a new wave of Doppelgänger, a well-documented Russian campaign that clones real news websites and makes them look like legitimate sources. The technique is insidious: a reader sees what appears to be a familiar newspaper or news portal, but the articles are fabricated, the bylines are invented, and the goal is to seed confusion, anger, or distrust. These cloned sites are often shared by networks of accounts that amplify each other, creating the illusion of organic popularity. If the Yandex strikes had truly disrupted Russian bot infrastructure, these networks would be among the most likely places to see the damage. A sudden silence, a broken posting rhythm, a drop in coordination—any of these would have been a signal. But according to Iliuk, none of that happened. The networks LetsData follows did not stop posting, did not fall into unusual silence, and did not break their established patterns. Some accounts were slightly less active, but the analysts said that was normal for the time of week. The networks operate on a weekly cycle, and the check happened to fall in a period when they usually post less anyway. In other words, what looked like a possible effect of the strikes was actually just the ordinary ebb and flow of disinformation work.
To understand why this finding matters, it helps to look at the specific networks LetsData examined. The company worked with two samples. The first covered accounts that systematically target Ukraine, Moldova, and Armenia—countries that have long been in the crosshairs of Russian influence operations, either because of direct conflict, political instability, or proximity to Russia’s borders. These networks tend to focus on local issues, exploit local grievances, and try to shape public opinion in ways that benefit Moscow. The second sample was different. It included bot networks that LetsData has followed for some time but that do not have a fixed target country. These networks are flexible and opportunistic. They shift their attention as events demand, moving from one country to another, one election to another, one crisis to another. A network that was spreading fake news about German elections two weeks ago might suddenly turn its attention to Ukrainian mobilization or a fabricated story about a Ukrainian state news agency. In fact, Iliuk described exactly that kind of shift. About two weeks before the Yandex strikes, one network from the second sample was writing about elections in Germany and spreading fake versions of Die Welt, a major German newspaper. After the strikes, that same network was posting about mobilization in Ukraine and sharing a fake site of Ukrinform, Ukraine’s state news agency. This fluidity is a hallmark of modern disinformation. The targets change, but the machinery keeps running. And that is precisely why the LetsData finding is so important. If the Yandex strikes had disabled the physical infrastructure behind these networks, the machinery would have at least sputtered. Instead, it kept humming along, changing topics and moving to new targets as if nothing had happened.
Of course, there are limits to what LetsData can see, and Iliuk was honest about them. The company can only compare activity within networks whose usual behavior it knows well. It cannot check the entire internet, because the scale is simply too large. There may be bot networks operating in parts of the internet that LetsData does not monitor, in private messaging apps, in closed forums, or in newly created accounts that have not yet been identified. The absence of evidence in the networks LetsData tracks is not the same as evidence of absence everywhere. There is also a broader confusion about what the Yandex strikes actually affected. After the attacks, a Cloudflare chart circulated online as supposed proof that bot traffic had dropped. But as Cybernews reported, that chart was counting automated web requests from Yandex’s network, including its search engine crawlers, not social media posts from bot accounts. It was a misleading metric that had nothing to do with the kind of influence operations that spread fake news and manipulate public debate. So the claim that the strikes muted social media bots rested on a false technical foundation. That does not mean the strikes were pointless. Yandex is a major Russian tech company, and its data centers are legitimate infrastructure in a war where digital infrastructure has become a battlefield. Hitting them may disrupt Russian services, complicate life for the Russian state, and send a message about Ukraine’s reach. But conflating those effects with a reduction in bot activity is a leap that the data does not support. And in the high-stakes world of election security, such leaps can be dangerous. If Western allies believe that a few drone strikes on data centers will protect European elections from foreign interference, they may neglect the harder, slower work of building resilience against disinformation.
The broader significance of this story goes far beyond one company or one set of drone strikes. It touches on a fundamental question of our time: can physical attacks on digital infrastructure actually stop information warfare? The appeal of the idea is obvious. It offers a concrete, targetable response to a threat that often feels abstract and everywhere at once. Russian influence operations are designed to be diffuse, deniable, and resilient. They use thousands of accounts, dozens of languages, and constantly shifting narratives. Faced with that kind of adversary, a missile hitting a server farm feels satisfying in a way that media literacy campaigns never will. But the LetsData findings suggest that the relationship between digital infrastructure and influence operations is more complex than the simple story suggests. Bot networks are not just software running on a few servers. They are human-machine hybrids, managed by people who can adapt, relocate, and rebuild. They are designed to survive disruption. The fact that the networks LetsData tracks continued their normal rhythms after the Yandex strikes is a reminder that disinformation infrastructure is not a single point of failure. It is a distributed, flexible system that has evolved to withstand exactly this kind of attack. That does not mean the strikes had no effect at all, but it does mean that the effect is not visible in the places where it would matter most for election security. And that is a sobering conclusion for anyone hoping for a technological shortcut to defeating information warfare.
In the end, the most honest answer may be the most human one: we simply do not know yet. Iliuk said that LetsData will keep watching and will report other signals if they appear. The networks it follows show no impact from the Yandex strikes, but the strikes may have affected networks outside the company’s current view. This uncertainty is uncomfortable, especially in a moment when politicians and publics crave clear victories. It is easier to believe that a drone strike can thin out the bots than to accept that the bots are still there, still posting, still shifting from German elections to Ukrainian mobilization with barely a pause. But the evidence matters more than the comfort. If we are going to defend democratic societies from foreign interference, we need to understand how that interference actually works. We need to look at the data, question the charts, and resist the temptation to overclaim. The Yandex strikes were a real military operation with real consequences for Russia’s digital economy. They may have disrupted services, destroyed equipment, and forced the Russian tech sector to scramble. But turning that into a claim about social media bots requires proof that has not yet been provided. Until that proof appears, the prudent position is humility. The fight against disinformation will not be won by a single dramatic strike. It will be won, if it can be won at all, through patient, sustained, evidence-based effort—the kind of effort that LetsData is trying to carry out, even when the news is not what people want to hear.