VideoPatrick BoylePatrick Boyle

Did Ukraine Just Bomb the Russian Bots?

Ukraine’s strikes on Yandex data centers sharply reduced automated traffic from its network, but Cloudflare saw no unexpected change in social-media activity. The damage highlights the tradeoff between keeping data inside national borders and protecting infrastructure from physical attacks, alongside the cost of cloud redundancy. The broader discussion traces influence operations from botnets and fake news sites to engagement incentives, noting that false or inflammatory content can spread widely even when organized campaigns fail to reach large audiences.

Preview · 17 more points in the app

Read the Full Summary

Key Takeaways

Ukraine’s strikes on Yandex’s data centers disrupted services beyond search: users reportedly lost payment-app balances, and some Moscow residents could not access apartment courtyards. Yandex shares fell about 11%, but a source close to management said restoring full capacity would take several months, while replacement servers could be slower and more expensive to obtain.

Russia’s data-localization law kept citizens’ personal data on servers inside Russia, which Boyle says insulated the Russian internet from Western sanctions but concentrated digital infrastructure within Ukraine’s drone range. Yandex’s example of running nine virtual machines in each of two locations illustrates the costly redundancy Boyle describes as insurance against outages; after the third strike, customers without capacity already arranged could not buy it.

The chart claiming a collapse in online activity around Germany’s AfD drew more than 4 million views despite including future-dated data and using a vertical scale that exaggerated the decline. That viral example sits alongside research finding that false news spread farther and faster than true news on Twitter, with political false stories 70% more likely to be retweeted.

Influence operations and online fraud can draw on extensive networks of compromised or rented devices: the 911S5 botnet allegedly supplied connections used for 560,000 fraudulent unemployment claims, while Google said EPIDA recruited devices through at least 600 Android apps and more than 3,000 Windows programs. A separate Latvian SIM farm held 40,000 active cards whose numbers had been used to open more than 49 million accounts.

DIGITAL-INFRA

Future-Dated Chart — A chart claiming to show online activity collapsing around Germany’s AFD party drew more than 4 million views, despite including data from three days in the future. The chart did not specify its subject or data source, and its vertical scale exaggerated the decline.

“On October 11th, a member of the European Parliament posted a chart on Twitter showing that online activity around Germany's AFD party had collapsed right after Ukrainian drones hit Russian…”—

Yandex Strikes — After Russia struck data centers in Ukraine, Ukraine sent drones into three of Yandex’s six major data centers. Two shut down completely, while the third lost several modules. Automated traffic from Yandex’s network fell by about 94%, almost entirely because of search crawlers; Yandex’s search network accounted for about 0.05% of global bot traffic.

“Well, over the previous month, Russia had been striking data centers in Ukraine, something the Russian Defense Ministry described on Telegram as a digital detox…”—

Social Activity — Cloudflare found no unexpected change in social-media traffic, including posting, replying, and liking. It cautioned that it could see only traffic passing through its network and could not rule out broader effects; as far as it could see, troll farms had not missed a day of work.

“Cloudflare then checked the thing people cared the most about traffic to social media sites including the parts of a platform that handle posting replying and liking from Russia or…”—

INFLUENCE-OPS

Doppelganger Sites — Since 2022, Russia’s Doppelganger campaign has cloned Western news sites, including fake versions of Der Spiegel, Le Monde, and The Washington Post. A fake Spiegel article appeared only to users connecting through a German IP address; everyone else was sent to a random website.

“Russia's best known campaign, which researchers call Doppelganger, has been cloning Western news sites since 2022, posting fake versions of Dur Spiegel, Leond, and the Washington Post on lookalike web…”—

911S5 Botnet — The 911S5 botnet allegedly rented out internet connections from millions of home computers infected through free programs and pirated software. Customers used those connections to file 560,000 fraudulent unemployment claims, among other things, and the administrator allegedly made about 99 million.

“In May 2024, the US Justice Department dismantled a network called 911S5, which the FBI described as likely the largest botnet ever…”—

EPIDA Network — Google disrupted EPIDA, a network that recruited devices through at least 600 Android apps and more than 3,000 Windows programs. In one week, Google countered more than 550 threat groups using it. Google also said EPIDA’s infrastructure helped support Kim Wolf, a botnet that infected more than 2 million devices, mostly Android TV boxes.

“In January, Google disrupted a similar network called EPIDA, which had recruited devices through at least 600 Android apps and more than 3,000 Windows programs that secretly turned them into…”—

SOCIAL-MEDIA

Foreign-Targeted Pages — An Institute for Strategic Dialogue report identified 128 Facebook pages and groups posting anti-migrant content aimed at British audiences, with a combined following of 1.6 million, and traced them to one man in Sri Lanka. Separately, a team examining nearly 6,000 posts from spammy news pages targeting Canada found that about 54% contained false or unsupported claims.

“A report by the Institute for Strategic Dialogue called Hate for Profit identified 128 Facebook pages and groups posting anti-migrant content aimed at British audiences with a combined following of…”—

Engagement Incentives — Facebook said it would train its AI to identify borderline content and show it to fewer people, but began paying creators based on engagement in 2024. Boyle argues that engagement-based compensation conflicts with the stated effort to limit borderline content.

“Facebook said that it would train its AI to spot borderline content and show it to fewer people…”—

False News Spread — A 2018 MIT study of about 126,000 Twitter stories found that false news spread farther and faster than true news across every category. Political false stories were 70% more likely to be retweeted, while true stories took about six times as long to reach 1,500 people. Removing bots did not change the gap; researchers’ best explanation was novelty.

“In 2018, researchers at MIT studied about 126,000 stories that spread on Twitter between 2006 and 2017…”—

The Future-Dated Bot Chart

A viral chart claimed Ukrainian strikes had crippled pro-Russian online activity, but its missing sources, unclear measurements, and future-dated data made the claim suspect.

Yandex Strikes And Cloudflare Data

The strikes damaged Yandex data centers and sharply reduced automated traffic from its network, largely by disrupting search crawlers rather than social-media activity.

Russia’s Data Localization Tradeoff

Russia’s data-localization rules insulated its internet from Western sanctions but concentrated digital services in infrastructure vulnerable to physical attacks.

Yandex Redundancy And Cloud Risk

The discussion explains how redundancy requires paying for spare capacity and why data sovereignty must be balanced against geographic concentration and infrastructure risk.

Residential Proxies And Botnets

Influence campaigns hide their accounts behind rented residential connections, compromised devices, phone farms, and botnets that are harder to disrupt than a centralized data center.

Government Influence Operations

Examples from Russia and other governments show how organized campaigns create fake personas and accounts, though reported operations often struggle to reach large audiences.

Political Rage Bait Economics

Foreign-run political pages exploit higher advertising rates for Western audiences, while platform monetization rewards engagement more than accuracy or consistent ideology.

Why Outrage Spreads

Research suggests real users, especially a small number of prolific sharers, drive much of the spread, and sensational or misleading content attracts stronger reactions.

Android TV Boxes And AI Risks

Weak default passwords and insecure devices make botnet recruitment easy, while researchers warn that small AI models could eventually spread across devices without a central point to disable.

Defenses Against Digital Worms

The proposed defenses are practical basics such as quarantining infected devices and banning default passwords, while automated persuasion remains a significant limitation.

Related Episodes

Important Disclaimers

Not Investment Advice: For education only — not financial, tax or legal advice.

AI-Generated: Made by AI from source transcripts and may contain errors.

No Guarantees: Past performance does not predict future results; investing carries risk.

Our Commentary · Request Removal