How russian bots took a beating

Ukraine's attacks on Russian digital infrastructure have led to a decline in bot network activity across Europe. In our country, several sovereignist politicians and influencers have recorded drops in Facebook likes and reduced engagement on social media, but the available data do not demonstrate that Russian influence operations in Europe have been permanently halted by Ukrainian strikes.

Ukrainian President Volodymyr Zelenskyy claims that the number of pro-Kremlin bots on social media has decreased. In Romania, monitoring data point to mixed developments: some pro-Russian channels have recorded declines in engagement, while activity among a sample of Facebook accounts within the disinformation ecosystem has continued.

• Three data centres hit within a few days

Between October 8 and 11, three data centres belonging to Russian company Yandex, located in Sasovo, Ryazan Region, Kaluga and Vladimir Region, were hit by Ukrainian drones. According to reports by Reuters and The Record, the attacks caused significant damage, with two data centres taken offline and the infrastructure of the third affected. Disruptions were reported in cloud, payment, delivery and transport services, including Yandex Go applications. The company confirmed damage to the infrastructure of the centre in Vladimir and the suspension of its operations. On Tuesday, the Kremlin announced that it was examining the problems facing the company.

Yandex is one of Russia's main digital service providers, and its infrastructure serves numerous applications and companies. Damage to the data centres has therefore raised questions about the impact on automated activities that rely on the network, including those associated with Russian propaganda.

• Zelenskyy claims that the number of pro-Kremlin bots has fallen

Speaking at the Warsaw Security Forum on October 12, Ukrainian President Volodymyr Zelenskyy said that, following the strikes on Yandex data centres, users of several social media platforms had noticed a reduction in hostile messages, provocations and divisive content. According to the Ukrainian news agency Ukrinform, the leader in Kyiv argued that the decline in bot activity demonstrated that these bots originated from Russian infrastructure. However, the Ukrainian president's statement reflects an interpretation of developments observed on social media, rather than a conclusion supported by a count of deactivated accounts. Establishing whether the attacks affected influence operations would require data on political accounts' activity, their behaviour and their technical links to the infrastructure that was hit.

• Automated traffic declined

One of the main arguments cited in support of the hypothesis that online propaganda has diminished is an analysis by Cloudflare Radar, which monitors internet traffic. Data analysed after the attacks indicate an approximately 94% decline in automated traffic associated with the Yandex network compared with the baseline used for comparison.

However, this indicator does not directly measure bot activity on Facebook, X or TikTok. A significant share of Yandex's automated traffic is generated by programs that access web pages to index them in its search engine, alongside other automated services. Organisations specialising in propaganda analysis, such as Cap or Botswatch, have published data showing that networks of automated accounts promoting pro-Kremlin messages, as well as messages supporting Western far-right parties (such as AfD in Germany or MAGA movements in the United States), recorded a decline in activity of up to 94% during this period.

In an analysis published on Tuesday, Ukrainska Pravda explained that the Cloudflare chart does not make it possible to establish the number of fake political accounts or identify users distributing propaganda. The same caveat appears in analyses by Kyiv Independent and Euronews, which consulted specialists in disinformation monitoring. Therefore, the collapse in automated traffic from a particular infrastructure cannot automatically be interpreted as the disappearance of political bots. The two types of activity may overlap, but they are not equivalent.

• The Pravda network and Romanian-language pro-Russian channels

Another indicator monitored after the attacks is the volume of content published by the Pravda network, a collection of websites distributing material and narratives favourable to the Kremlin in several languages. According to data analysed by expert Nicolae Ţîbrigan and presented on a television channel, the number of articles published by the network fell from approximately 10,340 on October 9 to 7,866 on October 11, a decline of around 24%. This development may indicate a temporary slowdown in publishing activity. In the Republic of Moldova, RFI data presented by Moldova 1 indicate an almost 49% decline in the prevalence indicator for pro-Russian content monitored by the GladiOS tool across 29 Romanian-language channels between October 8 and 12. During the same period, the average number of reactions to content posted by the channels analysed fell from approximately 1,633 on October 10 to around 655 on October 12, a reduction of almost 60%. These figures describe changes in content and engagement within the monitored environment. They do not represent the number of deactivated accounts and do not show how many reactions came from bots. Furthermore, an analysis published by Context.ro on October 13, based on data from Qriton Technologies, shows that pro-Russian networks targeting Romania and the Republic of Moldova continued publishing after the attacks. For example, the Telegram channel associated with the Romanian website romania.news-pravda.com published 496 posts between October 1 and 12, despite having only 44 subscribers. Other channels within the same ecosystem also remained active, including romania_ru, uraganasupraeuropei and InfoDefenseRUM. These data suggest that damage to certain data centres did not stop the distribution of pro-Russian propaganda in the Romanian-speaking information space.

• Romania: fewer likes, but no widespread disappearance of activity

In Romania, the discussion has also focused on engagement recorded by the pages of certain politicians and influencers from the sovereignist camp. Some posts by George Simion and people supporting Călin Georgescu have recorded declines in the number of likes. These developments have fuelled the hypothesis that part of their online popularity may have been sustained by automated activity. However, comparisons between posts do not make it possible to establish the proportion of artificial engagement. The number of likes can vary depending on the subject, the time of publication, content distribution and platform algorithms, and a decline does not prove that the users concerned were bots.

• Influence networks do not depend on a single data centre

Influence operations do not rely exclusively on servers located in Russia. According to experts cited by Kyiv Independent, networks associated with Russian propaganda use distributed infrastructure and can continue operating even when certain services become unavailable. A relatively small number of coordinated accounts can distribute messages that are subsequently picked up by real users and amplified by platform algorithms. In addition, the same narratives can circulate through different websites, Telegram channels and social media accounts, making it difficult to assess the effects of a strike against a single component of the infrastructure. In an analysis published on October 13, Ukraine's Centre for Countering Disinformation reported that the volume and intensity of posts in certain groups within the Pravda, InfoDefense and Nod of Time networks declined by approximately 50% for around 12 hours after the attacks, with activity subsequently resuming. The institution also reported declines in views for certain individuals promoting Kremlin-aligned narratives in France and the United States, without publishing a figure for deactivated accounts or a specific estimate for Romania. These observations are consistent with the hypothesis of temporary disruptions, but they do not demonstrate that Russian influence operations have been paralysed.

The sequence of events points to a link between the attacks on Yandex data centres and changes in certain online propaganda indicators. The decline in automated traffic, the reduction in the volume of articles published by Pravda and the decrease in engagement across some channels are relevant signals.