Ukrainian strikes silenced Russian bots, claim Ville Niinistö and Zelensky – experts disagree on whether there is evidence

Ukraine’s strikes targeted data centers belonging to Yandex, a major Russian technology company. Yandex provides services that experienced widespread disruptions after the attacks. The facilities became central to the claim because some online observers connected the outages with an apparent fall in Russian automated traffic.

Cloudflare data showed that automated traffic from one Yandex company’s server network collapsed after the strikes. Some politicians and commentators treated that fall as evidence that Russian propaganda bots had also gone quiet. Yandex’s importance made the timing appear persuasive, especially because the strikes occurred several times within a few days.

However, the article says the connection was not proven. Yandex’s automated traffic can include search crawlers and services processing news feeds. That is different from fake social-media accounts. The strikes may have disrupted some online activity, but no broad, measured shutdown of Russian influence accounts had been established.

A social-media bot is an automated account that posts, shares, replies, or behaves like a person on a platform. It may be used to spread political messages, amplify comments, or create the impression that many users support a view. The article also refers to such accounts as fake profiles or synthetic personalities.

Ordinary automated internet traffic is broader. For example, Yandex may automatically crawl websites, index pages, or process news feeds. Cloudflare calls this activity “bot” traffic too. That label does not mean the traffic comes from fake social-media accounts, propaganda operators, or hostile influence campaigns.

This distinction matters because Cloudflare’s data measured automation from a Yandex server network, not the activity of Russian influence accounts. F-Secure expert Joel Latto warned that the word “bot” creates confusion. A fall in general automated traffic therefore cannot directly measure whether social-media propaganda accounts became less active.

Cloudflare’s data showed a collapse in automated traffic from one Yandex company’s server network after Ukraine’s strikes. This was a real change in the measured network activity. The finding helped fuel claims that Russian propaganda bots had become silent, especially because it followed several attacks on Yandex facilities.

The measurement covered automated internet traffic, not a complete census of social-media accounts. Such traffic can include Yandex’s search systems crawling websites or processing news feeds. Cloudflare used the English word “bot” for this activity, but that meaning is wider than fake profiles on social platforms.

The article therefore treats the data as insufficient proof of a propaganda shutdown. Antibot4Navalnyi said the graph revealed nothing about hostile Russian bots on social-media platforms. F-Secure’s Joel Latto also said the data was being interpreted incorrectly. The traffic decline may reflect disrupted Yandex services, not disappearing influence operators.

A sharp fall in Yandex’s automated traffic measures activity on Yandex’s server network. It does not identify who was posting on social-media platforms or whether those accounts were Russian, automated, or politically motivated. The article says no clear evidence showed large-scale silencing.

For example, Yandex automation might crawl internet pages or process news feeds. A fake social-media account might instead publish replies, share content, or imitate a real user. Both can be called “bots,” but they perform different tasks and may use different infrastructure. Cloudflare measured the first category, not the second.

This is why the article presents competing interpretations. F-Secure saw possible reductions in Telegram media activity, while Antibot4Navalnyi and CeMAS rejected the broader conclusion. Niinistö also acknowledged that Cloudflare’s figures could not directly prove a social-media decline. More specific platform data would be needed to establish that claim.

A disruption to online infrastructure can make it harder to collect information, distribute media, coordinate accounts, or maintain automated services. That could reduce the amount or speed of propaganda and disinformation reaching audiences. The article reports this only as a possible effect, not a confirmed overall outcome.

F-Secure’s Joel Latto cited observations that Telegram contained significantly fewer media files, images, and videos after the attacks. He estimated that the volume may have fallen below half, while stressing that activity had not disappeared. This is one concrete sign that some communication or distribution processes may have been affected.

Other investigators reached a different conclusion. Antibot4Navalnyi called the idea of broadly reduced bot traffic wishful thinking. Germany’s CeMAS said Russian disinformation campaigns had not weakened because of the strikes. The current evidence therefore suggests uneven effects, with some services disrupted but no proven collapse of Russian influence operations.

This article does not quantify how many networks, devices, or countries modern influence operations use. It mentions Russian campaigns, social-media accounts, Telegram activity, Yandex infrastructure, and international monitoring groups. Those references show multiple parts of an ecosystem, but they do not establish its total scale or geographic distribution.

More generally, influence operations can be distributed across accounts, hosting systems, internet connections, and devices in several locations. Operators may use both automated systems and human-controlled accounts. That makes one company’s server-traffic graph a poor measure of the entire operation. This general explanation goes beyond the article’s reported figures.

The evidence presented here is therefore limited. Cloudflare observed a major fall in automated traffic from one Yandex server network. It did not reveal the size or location of all Russian influence infrastructure. Antibot4Navalnyi and CeMAS consequently rejected the claim that the broader disinformation system had clearly weakened.

Automated accounts can make a political narrative appear stronger by repeating the same message across many posts, replies, or shares. Repetition increases visibility and can make a small group seem like a large public movement. This explanation uses established knowledge about social-media automation; the article mainly identifies the accounts as fake or automated profiles.

A coordinated network might publish similar messages, react to one another, and push content into more users’ feeds. Other accounts may then mistake the activity for genuine public support. The article connects Russian bots with propaganda and disruptive accounts, but it does not provide a specific campaign example showing these steps.

The distinction remains important in this case. Cloudflare recorded automated Yandex traffic, not the number of coordinated social-media posts or accounts. Therefore, its graph cannot establish how widely a Russian narrative was amplified. Measuring that effect would require platform-level evidence about account behavior, reach, and coordination.