Ukraine bombed the hell out of some major Yandex data centers, and for about five minutes, it looked like maybe – just maybe – we’d see a real dent in Russia’s massive bot operation. Spoiler alert: we didn’t.

Cloudflare’s been tracking what happened next, and honestly? It’s both impressive and infuriating. Those bots didn’t just disappear into the digital ether. They migrated. Like cockroaches when you turn on the kitchen light, except these cockroaches had a backup plan and auto-migration protocols that kicked in almost immediately. We saw this same migration pattern after Strike at the Source: Sberbank's Data Center Hit, where the infrastructure adapted within hours.

The Numbers Don’t Lie (But They’re Depressing)

Here’s what we’re looking at: 170 million automated attacks that just… kept going. Traffic on Yandex Search and Yandex.Cloud dropped to somewhere between 10% and 15% of normal levels, which sounds great until you realize that the malicious activity didn’t actually stop. It just moved.

The bots shifted to other hosting providers – Radist and Selectel are the big ones Cloudflare flagged – and basically set up shop there instead. And look, I get it. This is how modern infrastructure works. Everything’s distributed, everything has failover systems, everything’s designed to survive exactly this kind of disruption. But when the thing surviving is a massive disinformation and attack operation? That’s a problem.

What’s interesting (and by interesting I mean frustrating) is that Yandex Search traffic that remained was mostly legitimate. We’re talking verified search crawlers doing normal indexing stuff. The clean traffic stayed relatively clean. But Yandex.Cloud? That’s where things get messy.

Vulnerability Scanning Never Takes a Day Off

Before the strikes, Yandex.Cloud was crawling with malicious activity – vulnerability scanning, probing, all the greatest hits of cyber-badness. The bombing did slow that down, Cloudflare confirms. But here’s the kicker: the “high-volume automation” didn’t vanish. It migrated.

I mean, of course it did. These operations aren’t run by amateurs sitting in a basement somewhere manually clicking buttons. They’re sophisticated, automated, and built with redundancy in mind. You don’t maintain a 170-million-attack bot network without planning for contingencies.

Why This Feels Like Whack-a-Mole (Because It Is)

The whole thing reminds me of trying to fight spam email back in the early 2000s. You’d block one domain, and three more would pop up the next day. Except now we’re not talking about Nigerian prince emails – we’re talking about coordinated disinformation campaigns and infrastructure attacks that can actually destabilize things.

And the infrastructure itself is part of the problem. Cloud hosting is everywhere. It’s distributed by design. That’s actually one of its biggest selling points – resilience, redundancy, geographic distribution. But when bad actors use those same features? Suddenly the thing that makes modern internet infrastructure so robust is also what makes it nearly impossible to shut down a determined adversary. Ukraine's learned this lesson the hard way before – remember when Starlink Blackout Grounds Ukraine's Drone Fleet showed how fragile even the best tech infrastructure can be during active conflict.

Ukraine’s strike was strategic, it was bold, and from a military perspective it probably achieved several objectives. But from a “stopping the bots” perspective? Not so much. The bot operators had already planned for this. They had backup hosting lined up. They had migration protocols ready to go.

“High-volume automation did not vanish – it simply migrated to other hosting providers.”

The Bigger Picture Nobody Wants to Talk About

Here’s what keeps me up at night about this: if a literal military strike on physical data centers can’t meaningfully disrupt these operations for more than a hot minute, what can? I’m not being rhetorical here. This is a genuine question that I don’t think we have a good answer to yet.

The bot networks are hydra-headed. Cut off one hosting provider, two more are ready to take over. The economics make sense for the attackers – cloud hosting is cheap, especially when you’re a state-sponsored operation with effectively unlimited budget. The technical barriers are low. The detection and mitigation tools we have (and Cloudflare’s doing good work here, don’t get me wrong) are basically reactive.

We’re fighting yesterday’s battle. Always. By the time we’ve identified a bot network, characterized its behavior, and deployed countermeasures, it’s already morphed into something slightly different. Same goals, different tactics. Same infrastructure pattern, different hosting provider. The same cat-and-mouse dynamic plays out everywhere tech meets adversarial behavior, from Always Listening: Meta's Glasses Caught Recording in Secret to state-level bot operations.

What This Actually Means

Look, I don’t have a magic solution here. Nobody does. But we need to be honest about what we’re up against. This isn’t a problem you solve with one surgical strike or one clever technical fix. It’s an ongoing, resource-intensive game of cat and mouse, except the mouse has infinite lives and respawns instantly.

The 170 million attacks that survived Ukraine’s strike aren’t going anywhere. They’ll keep probing, keep scanning, keep pushing disinformation, and when we finally figure out how to block them on Radist and Selectel, they’ll just move somewhere else. And the cycle continues.

Maybe the real question isn’t how do we stop this, but how do we build systems resilient enough that these attacks become white noise instead of existential threats. Because right now? We’re still very much in the “existential threat” phase, and that should worry all of us.