VasyGrek arrests: how Russia polices its own hackers
The VasyGrek case fits a pattern in which the line Russia draws around cybercrime runs through the victim, not the crime. A rare arrest…
After Ukrainian drones hit three Yandex data centres, officials and commentators said Russian disinformation had fallen in Ukraine, Europe, the US and the UK. The evidence published so far does not support that, and the traffic chart behind the claim measured something else.
Enable JavaScript and use a browser with spoken audio support to listen.
Read aloud by your browser. Voice and availability depend on your device.
On 12 October, speaking to the Warsaw Security Forum, Volodymyr Zelensky said it had become easier to breathe on social media since Ukraine’s drones reached Yandex’s data centres. By Euronews’s account, he said there were fewer bots and less hate, and that it was clear where the bots had come from. The Kyiv Independent reports that a Polish minister who coordinates the special services went further and claimed internal security service information showing a radical fall in Russian bot activity, without publishing any data. Posts on X said the same about the AfD, MAGA and Reform UK. The question is whether the strikes directly reduced Russian disinformation in Ukraine, Europe, the US and the UK. Nothing published so far shows that they did.
Reuters reported that three of Yandex’s five large data centres were taken out of action in four days. Yandex said Sasovo was completely shut down and part of Kaluga was out of service, and on 11 October it said Vladimir was completely suspended. The damage was real. Reuters reported that Sasovo houses two of the three supercomputers used to develop Yandex’s AI model, but Yandex’s own 9 October statement says it is very difficult to say when the equipment will be back up, and how much computing capacity was lost is not public. That is a separate question from disinformation.
Ukraine. The nearest thing to data is Graphika’s, and it points away from a collapse. Its monitoring found Ukrainian, Iranian and Romanian Telegram channels moving by only 4 per cent either way after the third strike. Posting fell 5 to 15 per cent in Russian-language channels, which Graphika does not explain and which could simply reflect disruption inside Russia. Zelensky’s remark describes how platforms felt to him, and nobody has published a measurement behind it.
Poland and Germany. Poland’s NASK disinformation centre recorded no significant decrease in disinformation accounts between 30 September and 11 October, according to the Kyiv Independent. The viral AfD chart named no source. Graphika’s own count had its AfD-related community posting 40,365 times on Sunday 11 October against 42,040 a week earlier, a dip well inside that community’s normal swings.
The US. Graphika found MAGA mentions on X up 25 per cent in the first eight hours after the Vladimir strike, against the same hours on earlier Sundays. Cloudflare checked bot requests to the post, reply and like endpoints of one social platform and found no unexpected change from Russian-origin or global addresses, though it cautioned that its view stops at its own network.
The UK. Graphika reports that none of the communities named in the claims, Reform UK’s among them, lost its active accounts or heaviest posters. One widely shared version of the story put the Reform logo beside a chart that contained no Reform data.
The strongest statement any of this supports is cautious. Graphika assessed with moderate confidence that the Western communities showed no silencing. No major fact-checking or monitoring group, the Kyiv Independent found, has reported a sharp fall.
Subscribe
New essays and snapshots, by email, roughly weekly.
The figure that keeps resurfacing is a fall of about 40 per cent in bot traffic from Yandex Cloud, taken from Cloudflare’s analysis of its own network. It does show something, though the thing is narrow. The sharpest falls were in vulnerability scanning and plugin probing, down roughly 90 per cent, and the cloud network supplied about 2 per cent of Russia-origin bot requests. It measures requests to websites, so it counts no posts or accounts. A fall of that kind can be read as brief friction for scanners and a cost to Yandex’s own customers. Cloudflare’s clearest example of what happened next involved one gambling customer account. Immediately after the 8 October disruption, requests from Yandex Cloud to that account stopped and identical requests with the same technical fingerprint began arriving from other Russian hosts. Across Cloudflare’s network, Russian bot traffic to gambling accounts as a whole rose 1.4 per cent over the week. Neither figure says anything about a political operation.
The other chart, showing Yandex’s search network at under half a per cent of its peak, largely measures the company’s own search crawlers. Their traffic collapsed during the disruption.
Researchers quoted by the Kyiv Independent explain why a data-centre strike should not be expected to reach these operations. Dave Troy points to documented troll operations run from places such as North Macedonia and the Philippines, which would be unaffected. The monitoring group Bot Blocker sees no dramatic drop among Kremlin-aligned trolls for hire and doubts that the Storm-1516 network, which looks like a commercial engagement-for-hire service, runs from Yandex at all. The Internet Research Agency famously worked from an office building in St Petersburg, as Gizmodo notes. Operations like these need people, accounts with history and an audience, and they can rent capacity from whichever provider has it. Replacing damaged specialist hardware may be harder than moving a workload, but the actual loss of computing capacity is not established.
The strongest counter-reading is that none of this excludes an effect. These comparisons constrain claims of a widespread collapse and leave smaller effects unresolved. Monitors have short windows and see only what they watch, so a small operation could have stalled unnoticed, and Graphika says some of its figures were incomplete when pulled. The measurements described here also count posts and accounts, not reach, and stable posting does not show stable amplification. Commentators cited lower impressions on posts linked to the Storm-1516 network, the Kyiv Independent reports, and nothing published here tests that. Disinformation is also hard to measure in real time, and Zelensky may have noticed a real change in his own feed. Strikes can be justified on other grounds, and an effect could still emerge later. All of that leaves the position as unproven, which is different from established.
A claim that strikes cut disinformation should name the operation, show that its output fell, and trace the fall to the damaged site. The Yandex claims did none of this, and they came from a head of state and a minister as well as from anonymous accounts. Dave Troy warns, per the Kyiv Independent, that overstating the strikes’ effect carries its own strategic risk, and that applies to allies as much as to adversaries. Russian interference is a serious problem. Judging countermeasures against it depends on knowing which operations were interrupted, for how long, and what it cost to replace what was lost. A single traffic chart cannot show any of that.
Disclosure: Claude was used in the research and drafting of this piece.
Sources: Euronews (12 October 2026); Kyiv Independent (13 October 2026, updated 14 October); Cloudflare Blog, “Yandex outage” (14 October 2026); Graphika (13 October 2026); Gizmodo (12 October 2026); Yandex press release (9 October 2026); Reuters, carried by The Star and Al Jazeera (11 October 2026). Via the Kyiv Independent: the Polish minister’s claim and the NASK, Bot Blocker, LetsData and Troy statements. Via Euronews and Gizmodo: Zelensky’s remarks.
Subscribe
McCyber intelligence briefings and structural essays, directly. No institutional spin.