Ukraine’s Yandex Strikes Cut Anti-Israel Bots 60% [2026]

Israeli Prime Minister Benjamin Netanyahu said on October 18, 2026, that online activity by Russian accounts targeting Israel fell by 60 percent after Ukrainian strikes damaged data centers belonging to Yandex, the Russian technology company often described as “Russia’s Google.” The claim, made as Netanyahu presented Israel’s new security doctrine, has quickly become one of the most contested data points to come out of the conflict between Kyiv and Moscow this month, with several outlets and researchers questioning whether the figure reflects a real collapse in disinformation activity or something far less dramatic.

The remarks tie together two stories that had, until now, run on separate tracks: Ukraine’s campaign of strikes against Russian data-center infrastructure, and Israel’s long-running complaints about coordinated online harassment campaigns it attributes to Russian-linked networks. Netanyahu’s statement, reported by The Gaze and by UA.NEWS, was blunt: “I don’t know if you saw it, but Yandex was hit in Russia. Sixty percent of online activity by Russian users directed against us disappeared. That tells you what kind of power there is here.”

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What actually happened to Yandex’s data centers

The underlying physical events are better documented than the bot-activity claim layered on top of them. Between October 8 and October 11, 2026, Ukrainian forces struck three Yandex facilities inside Russia: a data center in Sasovo, in the Ryazan region, which Yandex itself confirmed had stopped operating after a fire broke out following the attack; a second facility in Kaluga region hit a day or two later; and a third site in Vladimir region struck on October 11. The BBC described the Vladimir strike as the third attack on the Russian tech giant’s sites within a single week, forcing Yandex to pause operations at the facility near Moscow.

The cumulative effect, according to reporting from Ukrainska Pravda, was disruption to more than 80 Yandex Cloud services, with knock-on effects on unrelated platforms that rely on Yandex infrastructure, including banking apps and ride-hailing services in Russia, Kazakhstan and Belarus. That scale of disruption is the part of the story with the clearest paper trail: Yandex’s own press office acknowledged the Sasovo fire, and outage trackers recorded measurable service interruptions across the company’s cloud division in the days that followed.

Where the story gets murkier is the claim that these strikes amount to a “cyberattack” in the technical sense. Every detailed account of the incident describes drone strikes on physical buildings, not a network intrusion, credential compromise, or malware deployment. Treating a kinetic strike on a data center as equivalent to a cyberattack blurs a distinction that matters for anyone assessing Russia’s actual exposure to digital sabotage versus physical sabotage of digital infrastructure.

Netanyahu’s 60 percent figure, and why researchers are skeptical

Netanyahu’s statement did not come with a published methodology, a named dataset, or an independent audit. According to RFE/RL, Ukrainian President Volodymyr Zelenskyy made a related claim around the same time, saying the strikes on Yandex had lowered the volume of internet bots promoting pro-Kremlin messaging, a claim RFE/RL reported had been disputed by multiple technology researchers who reviewed the available traffic data.

The skepticism centers on what was actually measured. Cloudflare Radar data cited in multiple reports showed automated requests originating from the Yandex network falling to roughly 0.4 percent of a recent peak in the days after the strikes, a figure that sounds dramatic until you consider what it measures: traffic passing through Yandex’s own crawling and hosting infrastructure, not a verified census of accounts engaged in coordinated anti-Israel messaging. A drop in Yandex-originated bot traffic is consistent with data centers going offline. It is not, on its own, evidence that a specific category of politically motivated bot activity targeting Israel fell by exactly 60 percent.

DigitalShield put the distinction plainly in its own reporting on the strikes, drawing a line between the confirmed military and infrastructure damage and the much less substantiated claim of a bot-network collapse. Its analysis noted that one of the three facilities, in Sasovo, was knocked completely offline on October 8 after a fire, the first genuinely significant Ukrainian strike against a Russian data node, while the subsequent claims about bot traffic rest on indirect and contested signals rather than a confirmed account-level takedown.

Separately, Netanyahu offered additional color on what he believes the strikes disrupted. In remarks reported outside the thegaze.media piece, he described the target as “networks, bot activity against the State of Israel with the most blatant anti-Semitism possible,” framing the Yandex disruption as incidental proof of a much larger Russian-linked influence operation aimed at Israel. That framing, while politically resonant, still rests on the same unverified causal chain: data centers went down, and some measure of online activity dropped, but no public report has tied those two events together with a named dataset an outside researcher could check.

Timeline: three strikes in four days

Date (October 2026)	Facility	Reported outcome
October 8	Sasovo, Ryazan region	Fire following strike; Yandex confirmed the center ceased operations
October 9	Kaluga region	Second, larger facility reportedly struck; infrastructure disruption reported
October 11	Vladimir region	Third facility struck; Yandex paused operations at the site, per the BBC
October 13-14	Network-wide	Cloudflare Radar showed automated Yandex-network traffic near 0.4% of recent peak
October 18	Public statements	Netanyahu and Zelenskyy publicly linked the strikes to reduced bot activity

Why this matters beyond one politician’s talking point

The dispute over Netanyahu’s figure matters for reasons that go well past a single news cycle. Governments on both sides of the Russia-Ukraine conflict have increasingly treated unverified online-activity statistics as usable evidence in public statements, and once a number like “60 percent” is repeated by a sitting prime minister, it tends to circulate as fact regardless of its provenance. That pattern has shown up before in this war: official claims about cyber operations, drone interception rates and disinformation takedowns routinely outpace the underlying technical evidence, in part because the infrastructure needed to verify those claims, independent traffic logs, account-level audits, platform cooperation, is rarely made public.

For the cybersecurity industry, the episode is also a reminder of how loosely the word “cyberattack” gets applied to what are, in this case, conventional drone strikes on physical buildings that happen to house servers. That distinction is not pedantic. A real cyberattack against Yandex, a network intrusion that exfiltrated data, planted backdoors, or disrupted services through code rather than explosives, would carry very different implications for how Russian companies harden their digital defenses going forward. A drone strike on a data center is a kinetic military action with digital consequences, closer in kind to the sabotage described in Poland’s Starlink fire investigation than to a credential-stuffing campaign or ransomware intrusion.

Yandex’s broader business position adds another layer. The company had announced Sona, described in its own investor materials as an AI model built to replace a full recommendation pipeline without hand-engineered features, on October 2, just days before the first strike. That timing means Yandex entered the week of attacks already mid-rollout on a major product push, and the disruption to its data-center footprint raises questions about how much of that infrastructure capacity the company can restore quickly versus how much needs to be rebuilt or relocated to other Russian providers.

Market and infrastructure impact

The strikes land at a moment when Russian technology infrastructure is already under pressure from sanctions and supply-chain restrictions. The European Union’s sanctions package targeting Russian chip and drone supply chains has steadily narrowed the pool of hardware Russian data-center operators can use to replace damaged equipment, which complicates any quick rebuild of the Sasovo, Kaluga or Vladimir facilities. Analysts tracking the broader pattern of strikes on Russian infrastructure, including the steady rise in drone activity detailed in coverage of Russia’s drone launches against Ukraine, note that both sides have escalated infrastructure targeting well beyond battlefield positions this year.

Within Russia, more than 80 Yandex Cloud services reportedly saw disruption, a figure that touches everyday consumer and enterprise tools well beyond search, including payment processing and logistics platforms that lean on Yandex’s cloud division for hosting. That kind of cascading dependency is one reason outages at a single major cloud provider can ripple across an economy, a dynamic also visible in unrelated contexts like the recent Revolut and Lloyds Bank outages in the UK, where a provider-level failure produced thousands of downstream complaints within hours.

Wall Street’s reaction to the broader Russia-Ukraine infrastructure conflict has been muted but present. Energy and tech-adjacent equities moved earlier this month as strikes on Russian industrial targets pushed oil prices toward $107 a barrel, a dynamic covered in detail around the tech-sector market wrap tied to Ukraine strikes. Yandex itself is not a US-listed company in a form that moves American indices directly, but its role as Russia’s dominant search, cloud and ride-hailing platform means sustained disruption to its infrastructure has second-order effects on Russian consumer technology spending that regional analysts are watching closely.

Historical context: information-war claims rarely survive scrutiny intact

This is not the first time a wartime claim about disinformation-network collapse has circulated faster than the evidence supporting it. Throughout the Russia-Ukraine war, both governments have periodically announced large-scale takedowns of bot farms, troll factories and coordinated inauthentic behavior networks, often citing round numbers that later proved difficult to verify independently. The pattern echoes earlier disputes over claimed air-defense interception rates and claimed cyberattack damage assessments, where official statements preceded, and sometimes outpaced, what outside technical reviewers could confirm from public data.

What is different about the Yandex episode is the chain of attribution involved. Rather than Ukraine claiming credit for disrupting its own adversary’s propaganda apparatus, it is Israel’s prime minister citing a third-party military action, Ukrainian strikes inside Russia, as evidence of a benefit to an entirely separate geopolitical conflict, the online harassment campaigns Israel says it faces from Russian-linked accounts. That three-way link (Ukraine strikes Russia, Yandex infrastructure goes down, anti-Israel bot activity supposedly falls) has more joints where the causal chain could break than a simple two-party claim, and each of those joints is exactly where critics have focused their skepticism.

Competitive and technical comparison: data-center resilience under physical attack

The Yandex strikes also offer an unplanned, real-world test of how major cloud and search providers handle the loss of regional capacity. Yandex, as Russia’s largest domestic cloud operator, had spread its compute across multiple regional facilities specifically to avoid a single point of failure, the standard approach used by every major hyperscaler. The fact that three separate facilities in three different regions were each struck within four days still produced measurable service disruption suggests that even well-distributed infrastructure can be degraded meaningfully when an adversary is willing to target physical sites directly rather than relying on network-based intrusion.

Metric	Reported figure	Independently confirmed?
Yandex facilities struck (Oct 8-11)	3 (Sasovo, Kaluga, Vladimir)	Yes, confirmed by Yandex and multiple outlets
Yandex Cloud services disrupted	80+	Yes, reported by Ukrainska Pravda
Yandex-network automated traffic vs. recent peak	~0.4%	Yes, Cloudflare Radar data cited in reporting
Anti-Israel online activity reduction	60%	No, Netanyahu’s claim, disputed by researchers per RFE/RL
Strikes classified as “cyberattack”	Widely used in headlines	No, reporting describes physical drone strikes

By contrast, Western hyperscalers facing regional outages, whether from storms, power failures or isolated hardware faults, typically publish post-incident reports detailing root cause and recovery timelines. Yandex’s public acknowledgment so far has been limited to confirming the Sasovo fire through its press office, without the kind of detailed service-level disclosure that would let outside analysts independently verify the scope of the Kaluga and Vladimir disruptions or estimate a recovery timeline.

What the dispute reveals about bot-detection methodology

Separating genuine bot-network disruption from simple infrastructure downtime is a persistent challenge in disinformation research, and this episode illustrates why. If a coordinated account network routes its traffic through Yandex-hosted infrastructure, taking that infrastructure offline will, by definition, reduce measurable traffic from that network, at least temporarily. That does not mean the accounts themselves were suspended, the operators identified, or the campaign permanently dismantled. It means the pipe they were using got cut. Researchers who study these networks generally distinguish between “traffic volume dropped” and “the network was dismantled,” because the first can be undone simply by migrating to different hosting within days, while the second requires identifying and removing the accounts and operators themselves.

Nothing in the public record so far indicates that Israeli, Ukrainian or independent researchers have published an account-level analysis showing specific anti-Israel bot accounts went silent, were suspended, or were otherwise identified and removed. The claim rests entirely on aggregate traffic measurements taken before and after the strikes, which is a meaningfully weaker form of evidence than a verified takedown.

Predictions: where this story goes next

• Expect independent researchers and outlets like RFE/RL to continue pushing for a published methodology behind the 60 percent figure, and expect neither the Israeli nor Ukrainian government to provide one in the near term, since the political value of the claim does not depend on technical verification.
• Yandex will likely migrate more of its domestic cloud workloads toward alternative Russian providers and newly hardened facilities, following the pattern already visible in early reports of service migration after the Sasovo and Kaluga strikes.
• Ukraine is likely to continue targeting Russian data-center and telecom infrastructure as a matter of declared strategy, following the same logic applied to drone and air-defense targeting described in the broader pattern of attacks against Russian industrial sites this autumn.
• Watch for a counter-narrative from Russian state media or Yandex itself disputing both the scale of the disruption and the 60 percent figure, aimed at undermining the political value Netanyahu and Zelenskyy have both drawn from the episode.
• Expect this to become a reference point in the upcoming Israeli election cycle, where Netanyahu has already built national-security messaging around the claim, regardless of whether outside verification ever materializes.

The bigger picture for cybersecurity reporting

For readers trying to separate confirmed fact from political framing, the safest summary is this: Ukrainian forces did strike three Yandex data centers in four days, Yandex did confirm at least one facility stopped operating, and Cloudflare did record a sharp drop in automated traffic from Yandex’s network. What remains unconfirmed is the specific claim that this translated into a 60 percent reduction in anti-Israel bot activity, a figure that originated from a political statement rather than a published technical assessment, and that multiple outlets, including RFE/RL and DigitalShield, have explicitly flagged as unverified.

That gap between confirmed infrastructure damage and unconfirmed information-warfare claims is likely to keep showing up as both sides of the Russia-Ukraine conflict, and now third parties like Israel, use infrastructure attacks as raw material for broader political narratives. For readers following the cybersecurity dimension of this war, the Yandex strikes are a useful case study in how quickly a measurable, confirmable event (three data centers going offline) can get stretched into an unmeasurable, unconfirmable claim (a 60 percent drop in a specific category of political bot activity).

Frequently asked questions

What did Netanyahu actually claim about Yandex?
Benjamin Netanyahu said that after Ukrainian strikes hit Yandex data centers in Russia, 60 percent of online activity by Russian users directed against Israel disappeared. He made the statement on October 18, 2026, during a presentation of Israel’s new security doctrine.

Was this really a cyberattack?
No. Every detailed account of the October 8-11 incidents describes physical drone strikes on Yandex data-center buildings in Sasovo, Kaluga and Vladimir regions, not a network intrusion or hacking operation. The word “cyberattack” in some headlines refers to the digital consequences of a kinetic strike, not a hacking incident.

Has the 60 percent figure been independently verified?
No. RFE/RL reported that technology researchers who reviewed the available evidence called it weak, and DigitalShield’s analysis explicitly separated the confirmed infrastructure damage from the unconfirmed bot-activity claim.

How many Yandex data centers were hit?
Three: facilities in Sasovo (Ryazan region) on October 8, Kaluga region around October 9, and Vladimir region on October 11, 2026.

What services were disrupted?
Ukrainska Pravda reported disruption to more than 80 Yandex Cloud services, with downstream effects on banking apps and ride-hailing platforms in Russia and neighboring countries.

What is Cloudflare’s role in this story?
Cloudflare Radar data, cited in multiple reports, showed automated requests from the Yandex network falling to roughly 0.4 percent of a recent peak after the strikes, which is the strongest piece of independently verifiable traffic data in the story, though it measures overall Yandex-network traffic, not specifically anti-Israel bot activity.

Did Zelenskyy make a similar claim?
Yes. According to RFE/RL, Ukrainian President Volodymyr Zelenskyy said the strikes had lowered the operation of internet bots promoting pro-Kremlin messaging, a claim that drew the same skepticism from technology researchers as Netanyahu’s figure.

What happens next for Yandex’s infrastructure?
Reports indicate Yandex may be moving some services to other domestic providers following the strikes, though no official statement has confirmed a permanent migration, a rename, or a broader restructuring of its cloud division as of October 20, 2026.

Related Coverage

• Set Up Passkeys and FIDO2 Keys: 13 Steps, 70 Min [2026]
• California Student Data Breach: ETS Hack Hits 5.7M [2026]
• Plex2Shell Exploit Hits 36,000 Unpatched Servers [2026]
• Florida DMV Breach: Hackers Claim 200,000 Records [2026]
• AI Agent Hacker Breaches 100+ Firms at $50 a Hit [2026]