The Propaganda Shutdown That Never Happened: When Infrastructure Damage Becomes an Information Operation

On 8 October 2026, a Ukrainian drone strike damaged a data centre operated by Russian technology company Yandex in Sasovo, in Russia’s Ryazan region. Further strikes affected facilities in Kaluga and Vladimir on 9 and 11 October, disrupting services across Yandex’s digital ecosystem. Within days, another claim began circulating: Russian propaganda bots had gone silent.

The claim was compelling, but the evidence did not support it. Viral charts showed a sharp decline in automated traffic associated with Yandex, which some commentators interpreted as proof that Russian influence operations had been disrupted. Yet the data concerned automated web requests, including search-engine crawlers, rather than coordinated political activity on social media. A separate graph claiming a dramatic decline in online activity around Germany’s Alternative for Germany (AfD) party had no credible data source. As Deutsche Welle’s fact-check explained, neither graph established that the strikes had silenced Russian propaganda networks.

It is crucial to differentiate this. The infrastructure damage was real; the claimed effect on Russian influence operations was not demonstrated. Nevertheless, the story of a propaganda shutdown travelled widely, including through political commentary. The case itself reveals a strategic communications problem that extends beyond this particular operation: physical disruption can become a narrative of strategic success before its actual effects have been established.

When damage becomes a story of success

The strikes obviously had tangible consequences. Yandex services and businesses relying on its infrastructure experienced disruptions, while the company worked to restore operations. Reuters’ reporting confirmed that three major facilities had been affected within days. The incident therefore presented a genuine case of infrastructure vulnerability.

The claim about propaganda bots followed a different trajectory. A decline in automated requests from Yandex’s network was interpreted as a decline in coordinated political messaging, without evidence connecting the two. As The Guardian reported on 14 October, researchers monitoring disinformation networks had not observed a corresponding collapse in posting patterns.

The communications problem is not that an inaccurate claim has circulated. It is that a technical indicator was converted into a strategic conclusion without the necessary analytical steps in between. The visible damage offered a compelling explanation for a perceived change in online discourse, and the explanation spread faster than the evidence needed to substantiate it.

This creates on its end a credibility risk. Claims that an adversary’s propaganda machinery has been disabled can amplify perceptions of operational success. But if those claims prove unsupported, subsequent corrections can weaken trust in the broader assessment. This does not diminish the significance of the infrastructure damage. It means that the damage and its purported effects on influence operations must be assessed separately.

Influence operations are not a single technical system

The assumption that damage to one technology provider necessarily disables a wider influence operation reflects an overly narrow understanding of how influence works.

Russian influence activity involves state-linked media, coordinated social-media accounts, intermediary websites, influencers and networks of human operators. These actors use different platforms and distribution methods. Some activities are automated; others rely on people producing, adapting and amplifying content. Disrupting one technical component does not automatically disable the wider network.

The European External Action Service’s Fourth Report on Foreign Information Manipulation and Interference provides a broader account of interconnected influence activity, including coordinated networks and multiple distribution channels. This is important when assessing what an infrastructure strike can achieve.

A network might lose access to a particular service while retaining its operators, content, audience relationships and ability to publish elsewhere. Conversely, disruption may impose meaningful costs even if activity continues: restoring services, changing providers and rebuilding distribution can consume time and resources.

Neither outcome should be assumed. The relevant question is not whether activity stopped, but which capabilities were affected, whether the network changed its behaviour and whether the effects persisted.

The information contest continues after the strike

The interpretation of the Yandex strikes became part of the wider contest over the meaning of the war. Ukraine could present the attacks as a response to Russian strikes on Ukrainian infrastructure. The suggestion that Russian propaganda activity had fallen offered an additional narrative of success, extending the perceived effects from physical damage to the information environment.

Russia, meanwhile, had reasons to emphasise service disruption, economic consequences and the resilience of its technology sector. The Kremlin’s acknowledgement that it was discussing Yandex’s operational problems, reported by Reuters, showed that the incident also created a domestic communications challenge.

Neither side’s framing establishes the actual effects of the strikes. It demonstrates how an operation can generate competing interpretations, each seeking to define what happened and why it matters.

For strategic communicators, the challenge is to report verified results quickly without presenting uncertain effects as established facts. Once a claim of success enters public debate, it can be repeated by political figures, commentators and media accounts, acquiring authority through repetition. If later evidence contradicts it, corrections may struggle to achieve comparable reach.

This is particularly consequential in counter-disinformation work, where credibility is a core operational resource. An overstated claim about an adversary’s capabilities can distort subsequent assessments and create unrealistic expectations about what a particular intervention has achieved.

Measuring disruption, degradation and recovery

The Yandex episode points to a practical framework for assessing the effects of infrastructure attacks. Governments, platforms and researchers should distinguish between four levels:

Physical damage: What infrastructure was hit, and what damage has been confirmed?

Technical disruption: Which services or functions stopped working, for how long, and with what observable consequences?

Operational degradation: Is there evidence that a specific influence network lost the ability to coordinate accounts, distribute content or reach its intended audiences?

Strategic effect: Did the disruption produce a sustained change in the network’s reach, behaviour or capacity to influence the information environment?

Each level requires different evidence. Photographs and company statements may establish physical damage. Service-status reports and network measurements can document technical disruption. Assessing operational degradation requires data linked to the relevant influence networks, while claims about strategic effect require longer observation and a clearer understanding of the operation’s objectives.

This distinction should inform both assessment and public communication. Authorities and analysts should identify what is confirmed, what is inferred and what remains unknown. A documented outage should not be presented as evidence of degraded influence capacity unless that connection has been established.

Monitoring must also continue after the immediate disruption. Analysts should establish baseline activity, examine changes in known networks, track the return of previously observed behaviours and assess whether reach or coordination has changed. A return to posting does not necessarily mean a network has regained its previous effectiveness; equally, a temporary decline does not prove a lasting success.

Cooperation between platforms, independent researchers and public institutions can improve these assessments. Sharing relevant indicators, preserving evidence and documenting changes over time can help establish whether a disruption affected identifiable networks and whether those effects endured.

Credibility is part of the strategic effect

The Yandex strikes demonstrated that digital infrastructure can be vulnerable to physical attack and that the consequences can extend beyond the immediate target. They did not establish that Russian social-media influence operations had been shut down.

For strategic communications, the distinction is fundamental. Physical damage, technical disruption and a sustained loss of influence capacity are different outcomes. Treating them as interchangeable risks turning a verified operational event into an unverified story of strategic success.

The objective should not be to produce the most persuasive account of an operation’s success. It should be to establish what changed, which capabilities were affected, whether those effects endured and what remains uncertain.

In an information environment where claims can travel faster than their verification, the credibility of strategic communications depends not on what is communicated, but also on the discipline with which results are assessed before they are declared.

Image: TCA / courtesy of Chosun Biz

____________________

By Mariam Gamdlishvili, Executive Director, SSI