Yandex Outage Reveals Malicious Bots Migrated, Not Disappeared
Cloudflare's analysis of the Yandex network outage indicates that while legitimate search crawlers were affected, malicious bots from Yandex.Cloud simply migrated to other providers rather than being neutralized.
Following reported Ukrainian drone strikes on Yandex data centers in early October 2026, speculation arose that Russian bot farms and influence operations had been significantly disrupted. Initial observations of steep drops in Yandex's network traffic fueled this belief. However, a detailed analysis by Cloudflare, leveraging its Radar and Bot Management data, reveals a more nuanced picture.
The key to understanding the impact lies in differentiating between Yandex's two primary autonomous system numbers (ASNs): AS13238, used by its search engine, and AS200350, which powers its cloud services. While both experienced significant traffic declines, the nature of the affected traffic differed considerably.
For Yandex Search (AS13238), the observed traffic reduction consisted almost entirely of legitimate search engine crawlers, such as YandexBot and its variants, indexing web content. This traffic was verified and performed expected functions like page indexing and rendering. The disruption primarily impacted the efficiency of search engine operations rather than posing a threat to malicious actors.
In contrast, Yandex.Cloud (AS200350), a cloud-hosting network, presented a different scenario. While some malicious activities like vulnerability scanning and probing did decrease, high-volume automated traffic did not vanish. Instead, Cloudflare observed that these malicious bots migrated to alternative hosting providers, indicating that the strikes had a limited long-term effect on the global landscape of malicious bot activity.
Before the strikes, automated requests constituted a significant portion of global internet traffic, around 36.1%. The Yandex Search ASN was responsible for a small fraction of Russia-origin bot requests (7%) and an even smaller global share (0.05%). Yandex.Cloud's bot traffic, while comprising a larger percentage of its own traffic (95%), represented only about 2% of Russia-origin bot requests and 0.01% globally.
The analysis showed that Yandex.Cloud's bots exhibited characteristics more akin to software applications, with a substantial portion sending data to websites and identifying themselves as programs written in various languages. This contrasts sharply with the verified search crawlers seen on the Yandex Search ASN. The decline in Yandex.Cloud traffic saw sharp drops in categories like WordPress plugin probing and scanner-identified requests, but the overall malicious automation persisted elsewhere.
Cloudflare's findings underscore the importance of analyzing request behavior rather than relying solely on aggregate traffic metrics. While the Yandex network outage was substantial, the migration of malicious bots to other infrastructure demonstrates the resilience and adaptability of threat actors. The event highlights that disruptions to specific infrastructure, even on a large scale, do not necessarily equate to a global reduction in malicious cyber activity.
This incident serves as a reminder that the origin of malicious traffic does not always reveal the identity of the responsible party. The ability of automated threats to quickly relocate to new hosting environments means that security efforts must focus on broader detection and mitigation strategies that are not tied to specific infrastructure.