The Disinformation War in the Russia-Ukraine Conflict: Bot Farms Still Operating After Drone Strike on Yandex

Ukraine's drone strikes on Russian data centers briefly raised hopes that Russia's disinformation machine would grind to a halt. But recent observations show that Russian bot farms are still operating, and opinion manipulation on social platforms has not disappeared despite the damage to infrastructure.

A Strike That Raised High Hopes

A few days ago, Ukrainian military drones successfully struck multiple data centers inside Russia. Ukrainian President Zelensky subsequently stated publicly that the operation had weakened Russia's disinformation dissemination capabilities.

"The atmosphere on many social platforms suddenly became a bit more relaxed," Zelensky said in a speech on Monday. "Less hate, less division, fewer provocations."

This kind of statement is not an isolated case. On the opinion battlefield of the Russia-Ukraine conflict, data infrastructure has long been regarded as a key node in information warfare. Data centers carry social platforms' content distribution, account management, and automated operations. Once destroyed, they should theoretically have a direct impact on the operational efficiency of bot farms.

Zelensky's optimistic assessment reflected Ukraine's expectation of the logic that "physical strikes weaken information warfare." But reality is often more complex than expected.

Why Bot Farms Are Hard to Eliminate Physically

The operation of bot farms does not depend entirely on a single large data center. According to observations from multiple sources, Russia's disinformation network employs a highly decentralized architecture.

On one hand, some automated accounts rely on cloud services and distributed servers. Even if certain nodes are destroyed, traffic can quickly shift to other nodes. On the other hand, a large number of "content farms" and human-operated teams are distributed across different geographic locations. They do not rely on centralized computing resources, but instead create opinion volume by registering accounts in bulk and copy-pasting content.

This "decentralized" characteristic makes it difficult for a single strike targeting data centers to produce a decisive effect. As one of Russia's most important internet infrastructure providers, Yandex's services may indeed have been somewhat affected, but the production and distribution network for disinformation has multiple backups and alternative pathways.

In other words, striking data centers can cause short-term chaos, but it is difficult to fundamentally dismantle an information manipulation system that has operated for years and is highly adaptive.

What Is a Bot Farm

A bot farm refers to a network operation system centrally controlled by a large number of automated accounts (bots), usually used to mass-post, repost, and like content on social media in order to manufacture false popularity or numerical advantage in public opinion. A typical bot farm may manage thousands or even tens of thousands of accounts, driven by scripts or AI, capable of simulating real human behavior for posting and interaction.

The operation of a bot farm depends on three elements: account resources, content supply, and network infrastructure. Accounts can be obtained through bulk registration or purchase; content is written manually or generated by AI and then distributed uniformly; network infrastructure includes servers, proxy IPs, and cloud services. Precisely because its architecture can be modularly separated, striking any one link makes it very difficult to completely paralyze the entire system—accounts can be rebuilt, content can be rewritten, and servers can be migrated. This is also why the effect of physical strikes on data centers is often limited.

Yandex's Position in the Russian Internet

Yandex is often called "Russia's Google" and is one of Russia's largest internet companies, with businesses covering search engines, email, cloud services, maps, ride-hailing, and news aggregation. In the information dissemination chain, Yandex not only provides a search entry point, but also provides hosting support for a large number of third-party services through its cloud infrastructure. Therefore, when Yandex's data centers were struck, outsiders naturally speculated that Russia's online information ecosystem would be significantly impacted.

But a distinction must be made: damage to Yandex's infrastructure does not mean that all information manipulation activities relying on social platforms will be interrupted. To a large extent, Russia's disinformation network relies on social platforms such as VKontakte and Telegram, as well as scattered cloud services and self-built servers. Yandex is only one node in the entire ecosystem, not the sole hub.

Actual Changes on Social Platforms

Although Zelensky claimed that the atmosphere on social platforms had improved, data from independent observers and research institutions does not fully support this claim.

In the days following the attack, a large amount of coordinated propaganda content still appeared on multiple social platforms. This content included negative narratives targeting Ukraine, aggressive remarks against Western countries, and attempts to amplify domestic Russian support for the war.

Some analysts pointed out that the operation of bot farms has a certain "elasticity"—when a platform or a server node is affected, operators quickly adjust their strategy and move activities to other channels. This rapid adaptability means that the effects of external strikes are often short-lived.

In addition, the production of disinformation does not depend entirely on automated bots. A large number of manually operated accounts, paid trolls, and voluntary information spreaders form a more complex ecosystem. Even if automated tools are restricted, manual operations can still sustain a certain scale of opinion manipulation.

The Enduring Challenge of Information Warfare

Information warfare in the Russia-Ukraine conflict has already proven that disinformation dissemination networks possess extremely strong resilience and adaptability. Physical strikes can cause short-term disruption, but it is difficult to completely eliminate a manipulation system that has already become deeply embedded in the social platform ecosystem.

For platforms and regulators, this means that responding to disinformation requires strategies with more dimensions. Relying solely on technical means or physical strikes makes it very difficult to solve the problem at its root. Identifying coordinated behavior, tracking account networks, and improving platforms' content moderation capabilities remain more enduring and systematic tasks.

Zelensky's optimistic statement is understandable, but the fact that bot farms are still operating reminds us: the battlefield of information warfare is far more complex than the physical battlefield, and it is also more difficult to achieve a decisive victory.

Identifying Coordinated Inauthentic Behavior

Coordinated inauthentic behavior is a core concept in platform governance and disinformation research. It refers to multiple accounts operating in coordination at the same time, with the same goal, and using similar rhetoric, rather than independently expressing opinions. It differs from disinformation published by a single account by emphasizing "networked" and "organized" characteristics.

Identifying coordinated inauthentic behavior usually relies on the following signals: concentrated account creation times, highly synchronized posting times, highly similar content text, abnormal interaction patterns (such as a large number of mutual likes and reposts within a short period), and hidden relationships between accounts (such as shared IP ranges or proxies). In recent years, platforms such as Meta and Twitter have regularly published coordinated inauthentic behavior reports and banned related account networks. But the difficulty of identification lies in the fact that operators continuously adjust strategies to evade detection, for example by reducing posting frequency, blending into real user topics, and using AI to generate diversified text. This has created a sustained technological contest between platforms and disinformation operators.

One-line Summary

After Ukraine struck Russian data centers, Russian bot farms are still operating, showing that information warfare resilience far exceeds the effects of physical strikes.

Paragraph Summary

After Ukrainian drones struck Russian data centers, Zelensky claimed that the atmosphere on social platforms had improved, but independent observations show that bot farms are still operating. Russia's disinformation network uses a highly decentralized architecture, relying on cloud services, distributed servers, and human-operated teams rather than a single data center, giving it strong resilience. After the attack, coordinated propaganda content still existed in large quantities on social platforms, and operators could quickly move activities to other channels. Disinformation production depends not only on automated bots, but also on manual trolls and voluntary spreaders, forming a complex ecosystem. Physical strikes can only cause short-term disruption and are unlikely to dismantle a manipulation system already deeply embedded in the platform ecosystem. Responding to disinformation requires systematic strategies such as identifying coordinated behavior, tracking account networks, and improving content moderation capabilities, rather than a single technical or physical means.