Is Zelensky Right That Attacks on Data Centers Have Wiped Out Russian Bots?

Experts Say There Is No Evidence Russian Trolls Were Affected by Ukrainian Attacks on Yandex

By Richard Irvine Brown, Shayan Sardarizadeh and Adam Durbin, BBC

Claims that Ukrainian attacks on Russian data centers have reduced botnets linked to the Kremlin have been widely circulated online, but experts have told BBC Verify that there is no evidence that the attacks have significantly decreased.

Viral social media posts claim there has been a significant drop in hacking operations in recent days, with Ukrainian President Volodymyr Zelensky suggesting on Monday there was "less hatred, less division and less provocation" online because of "fewer bots".

Russia's influence operation, which promotes pro-Kremlin narratives and spreads disinformation, has been tracked by researchers and journalists including BBC Verify for more than a decade.

These campaigns spread false information to people's social networks about topics such as the war in Ukraine or sending messages in support of Moscow's interests.

Since October 8, Ukraine has attacked three of the five data centers of the Russian technology giant Yandex in response to Moscow's attacks on Ukrainian Internet centers.

The second of the attacks on Thursday prompted Yandex, often referred to as Russia's Google, to announce that it was struggling to maintain its services.

But the attacks are said to have affected Russian disinformation operations, including accounts with messages of support for groups including the Make America Great Again (MAGA) movement in the US and the far-right AfD party in Germany, which appear to have come from misinterpreting data produced by technology firm Cloudflare.

Some social media users are sharing graphs from Cloudflare data showing that bot activity using the Yandex network has decreased.

While bots are commonly associated with fake social media accounts that may post false, divisive and inflammatory content, they are also used to automate tasks such as scanning web pages to appear in search engines.

Cloudflare clarified that its data includes all automated Internet requests to websites hosted on its network, including bots that crawl websites for information.

The company also said that the removal was "not necessarily the behavior of bots on social media platforms."

Czech MEP Tomasz Zedchovski shared a post on X that has been viewed more than four million times, saying: "If confirmed, this is telling news: Russian data centers are hit and online activity around the AfD suddenly drops."

He has since said that he "didn't present it as an outright fact," but the post was pinned to the top of his X profile.

Researchers from dTeam, a US-based group that tracks hacking operations linked to Moscow, told BBC Verify that "there was no diversion of traffic from known Russian accounts and bot clusters on any platform".

They added that if the offices of known groups involved in these operations "are on fire, we will see a change".

Bots linked to pro-Kremlin operations, such as evidence shared by the dTeam with BBC Verify, Storm-1516 and Matryoshka - both previously reported on by BBC Verify - were still active on social media on Tuesday.

Zelensky's office told BBC Verify that the president was "talking about the atmosphere on social media" rather than reducing bot activity. It added that it had seen "fewer reports of inflammatory and hateful comments" from many social media users.

In the third attack on the Russian tech giant, Ukraine attacked Yandex's data center

Russian search engine Yandex suffers after Ukrainian attacks on data centers

Is Burnham right to blame Russia for spreading misinformation online?

Mikhail Klimarov, an independent Internet analyst, told BBC Russia that while Cloudflare can determine whether bots or real people have visited a website, it does not reflect what the bots are doing.

He added that Yandex uses bots to "crawl the entire Internet basically once a day" and index websites for search engine purposes, so it's likely that the company turned off the bots in response to the severe degradation of its computing resources.

Yandex has said that using its cloud services for "large-scale manipulation of social media, spam and other improper activities" is against its rules, and accounts that violate this will be banned.

While there is no evidence to suggest that the attacks on Yandex data centers had any effect on Russian infiltration operations, they disrupted internet service for many.

Issyk Mater, director of research at internet watchdog group NetBlock, told the BBC that disruptions related to the Ukrainian attacks would affect "all users" globally and that "websites that rely on Yandex may be partially or completely unusable".

Following the Ukraine attacks, there was a clear impact on the company's cloud services and the platforms that rely on them, he said, adding that the entire "out of service" area represented a significant infrastructure-level incident rather than a brief service interruption.