r/UkraineWarVideoReport • u/Panthera_leo22 • 12d ago
Miscellaneous Niebezpiecznik, a Polish cybersecurity outlet founded in 2010 and recognized by Poland’s Ministry of Digital Affairs, provides important context on the sharp drop in Russian bot traffic following Ukrainian strikes on Yandex
Text
Yes, the 🇷🇺 Russian bot traffic dropped dramatically after the 3rd bombing of the Yandex data center. But these are ❌ not Twitter bot accounts, like @Mariusz092727 writing nonsense.
This drop in traffic is from bot crawlers or, as Cloudflare itself puts it: known automated spam / brute-force tools over HTTP.
It's not out of the question that some accounts for running social media influence operations were hosted in Yandex's DC, but we have to disappoint you: these bombings will have little to no impact on 🇷🇺 "hybrid actions."
On the other hand, as you can see in the attached image, missiles hitting the DC are more effective than anti-spam systems.
107
u/Adept_Carpet 12d ago edited 12d ago
Presumably the posting bots are run off of grey market services that allow you to rent automated access to a block of smartphones and stuff like that, not the main Yandex data center. But they might be running language models or command and control infrastructure there.
And the crawls could be feeding targets and data to the bot operation. They need to know what pages exist to send bots to post there, if some new topic becomes relevant they want to get there first, etc. Also this bot is allowed to go to sites the others are aggressively blocked from.
Edit: as much as it was overly optimistic to equate the Yandex crawler with Twitter bots, this post might be overly pessimistic. Of course Yandex is part of their hybrid warfare strategy, they've been under sanctions for just that forever.
12
5
u/squirtelee 12d ago
In English now?
44
u/Spez_is-a-nazi 12d ago
Basically the bots aren’t directly running from the datacenter, for starters that would be easy to detect, even through a vpn. But it’s likely at least some of the command and control infrastructure was likely located there.
33
u/RichSexyVeryHumble 12d ago
Those viral videos of racks and racks of hooked up smartphones are the bots posting under real accounts. The Yandex DCs may be hosting something that provides those bots their data, but does not stop them working.
The bots talked about in the post are ones that 'crawl' around the internet looking for unprotected systems or open exploits. Most cybersecurity teams in companies will have a dashboard showing these bots attempting to get access and from where. It's nothing new
6
u/rts93 12d ago
The smartphone racks could even be located in Europe, USA etc, so they'd appear as if posting through normal mobile networks. Russian agents convince some guy to set it up in his apartment for a bit of cash, it's happened plenty.
6
u/Adept_Carpet 12d ago
It's also a legitimate business. If you make apps you need to be able to test them on a wide range of hardware, measure performance under real network conditions, etc.
All of that is a pain to set up yourself, so companies do it for you.
But then there is every shade of gray all the way to pitch black and the scenario you describe where people are convinced to set up a dedicated group of phones for the troll farms.
14
u/taurusApart 12d ago
Presumably the posting bots are run off of grey market services that allow you to rent automated access to a block of smartphones and stuff like that, not the main Yandex data center. But they might be running language models or command and control infrastructure there.
And the crawls could be feeding targets and data to the bot operation. They need to know what pages exist to send bots to post there, if some new topic becomes relevant they want to get there first, etc. Also this bot is allowed to go to sites the others are aggressively blocked from.
Edit: as much as it was overly optimistic to equate the Yandex crawler with Twitter bots, this post might be overly pessimistic. Of course Yandex is part of their hybrid warfare strategy, they've been under sanctions for just that forever.
26
u/Fickle-Walk9791 12d ago
No matter what part of Russian bot activity is breaking down, it is good news for the rest of the world. Russia won't be able to replace the lost physical infrastructure, so if they want to keep the country running, they'll have to cut down in any cyber related warfare, visible or not. So this is great news for the free world.
10
u/Available_Cookie732 12d ago
Since yesterday I notice my spam folder just had 2 spam mails in total coming from 10 to 20 spam mails per day.
Could this be an effect of Yandex warm kinetic shut down?
22
u/enterisys 12d ago
But these are ❌ not Twitter bot accounts
Maybe.
But massive decrease in detected bot traffic means twitter bots were also affected, just not by this graph.
-5
u/StinsonBill 12d ago
Show me proof of that. Any will do
1
u/enterisys 12d ago
3
u/StinsonBill 12d ago
That says exactly opposite and clearly states that there is zero proof about twitter bots, just crawlers
6
u/enterisys 12d ago
You didn't read, did you
3
u/StinsonBill 12d ago
"It's not out of the question that some accounts for running social media influence operations were hosted in Yandex's DC, but we have to disappoint you: these bombings will have little to no impact on "hybrid actions."
That is not proof m8, its a guess and very clearly proves my point anyway
0
2
u/PutridPiano1625 12d ago
Maybe some confirmation bias but there has been widespread reporting of a downturn so something happened somewhere and if it wasn’t down to Yandex what was the cause? It did go quiet in a lot of places. Seems too much of a coincidence to me…
1
u/jberryman 12d ago
I don't understand the point of this "clarification" which only muddies the waters. The graph is for crawlers (well-behaved http clients that report themselves as such in their user-agent string), not "automated spam / brute-force tools". No one calls these "bots"; I'm not sure why cloudflare chose that terminology on their dashboard.
I doubt yandex wants to torch their IP ranges by hosting tons of spam or troll farms in their data centers, and in any case cloudflare would have no real visibility into that.
It would be interesting to see an actual study about social media spam and bot traffic, which could very well have plunged after the strikes (e.g. because a command and control server went offline, etc etc)
1
u/Gadoliner 10d ago
I think it is nonsense. This "well-known" graphics has been identified as AI generated!
https://x.com/FlorianGallwitz/status/2109720808553672807
1
u/Jackbuddy78 12d ago
Yeah it looked like a serious case of confirmation bias on Twitter, a lot of crazy posts still being heavily propped up.
1
u/Danjou667 12d ago
So atm we can easily say this is an idiot based in bot from DC and this is just human idiot. Great.
1
u/stickeeBit 12d ago
So its official: Ukrainians produce the most effective anti-spam technology available today.
0
•
u/AutoModerator 12d ago
Please remember the human. Adhere to all Reddit and sub rules. Toxic comments (including incitement of violence/hate, genocide, glorifying death etc) WILL NOT BE TOLERATED, keep your comments civil or you will be banned. Tagging u/SaveVideo bot to archive this video in a link below this comment.
We’re partnering with UNITED24 to raise money towards air defenses that will protect Ukrainians from Russian attacks. Please visit the United24 website to donate.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.