Yandex Outage: Malicious Bot Traffic Migrates Rather Than Disappearing
Network infrastructure damage fails to halt automated threats as bot operators quickly relocate workloads.
1Infrastructure Strikes and Traffic
Between October 7 and 11, drone strikes hit three Yandex facilities in Russia, causing significant network capacity loss. By October 11, traffic to Yandex Search dropped 99% below baseline, while Yandex.Cloud traffic fell 90%. Despite these physical disruptions, overall global bot traffic remained stable throughout the entire event period.
2Analyzing Two Distinct ASNs
The impact varied across two autonomous systems. AS13238, used for Yandex Search, saw a decline primarily in verified crawlers indexing web content. Conversely, AS200350, the Yandex.Cloud network, hosted a mix of legitimate software applications and malicious automation. This distinction is critical for understanding why total traffic drops do not signal operational failure.
3Search Indexing Impact
The traffic decline on the Yandex Search ASN consisted almost entirely of verified bots like YandexBot and YandexRenderResourcesBot. Publishing and newspaper sectors experienced the steepest drop, falling 44% as indexing ceased. This confirms that the primary consequence of the search network outage was reduced content discovery rather than malicious activity.
4Malicious Automation Migration
While vulnerability scanning and plugin probing dropped on Yandex.Cloud, high-volume malicious operations did not vanish. Evidence shows these operators simply migrated their workloads to other hosting providers like Radist and Selectel. The malicious traffic maintained identical JA4 TLS fingerprints and request paths, proving the automation remained active despite the infrastructure loss.
5Gambling Sector Evidence
The gambling industry provided clear proof of workload migration. Bot requests targeting a specific account dropped to zero on Yandex.Cloud following the disruption. Simultaneously, identical requests emerged from other Russian hosting networks. This shift occurred rapidly, demonstrating that operators can relocate their automated scripts to new providers within mere hours.
6Social Media Manipulation Claims
Speculation suggested that the strikes crippled Russian influence operations and social media manipulation. However, analysis of traffic hitting 'post', 'reply', and 'like' endpoints showed no unexpected changes. Both Russian-origin and global traffic patterns remained consistent, indicating that the physical infrastructure damage did not successfully disrupt these specific influence-related automated activities.
7Unreliable Traffic Metrics
Aggregate traffic metrics are misleading proxies for interpreting bot behavior. A drop in HTTP traffic only confirms that a specific network went offline, not that the underlying threat was neutralized. Security teams must look beyond volume-based metrics to identify persistent threats that are designed to be portable across different hosting environments.
8Defending Against Portable Threats
Defending against modern automated threats requires inspecting request behavior rather than relying on source network data. Security professionals should focus on identifying shared JA4 fingerprints, monitoring anomalous request rates, and applying WAF rules to sensitive endpoints. Since cloud workloads are highly portable, static infrastructure blocks are insufficient for stopping sophisticated botnets.
9Strategic Security Takeaway
Physical infrastructure is static, but malicious automation is built to be dynamic and resilient. The Yandex incident serves as a reminder that network-level disruptions do not equate to the cessation of automated threats. Security strategies must prioritize behavioral analysis to track and mitigate malicious actors regardless of their hosting provider or network.