After Yandex, Sber and VK: the strikes reach every pillar of Russia's whitelist

On the morning of October 18, 2026, VK, the company behind Russia’s biggest social network, published a statement two sentences long: a drone had attacked a VK data center in the Leningrad region, and VK’s services were available to users as normal. No site named, no damage described, no injuries mentioned. By then, by our own measurements, nearly half of the address blocks in VK’s St Petersburg network had stopped answering.

That statement closed an eleven-day sequence nobody in Russia’s tech industry had planned for. Between October 8 and 11, drones stopped three Yandex data centers, the subject of our first report, with the routing data and the legal map. On the night of October 14 they reached Sber’s giant data center under construction in Balakovo. On the night of October 18, VK. Five data centers, three companies, eleven days.

In part one we argued that the strikes cannot touch Russia’s censorship machine, which lives in filtering boxes inside carrier networks, but land squarely on the walled garden, the whitelist of domestic services that is all most Russians get during mobile internet shutdowns. The two new strikes test that argument on the whitelist’s other owners. This report covers what was hit, what our measurements show, how much of the whitelist runs on these three companies, and what happened to the one escape route that hides inside their own infrastructure.

What happened to Sber's and VK's data centers?

The Balakovo strike came first, on the night of October 13 to 14. The target was not an old server room but Sber's flagship regional project in the Saratov region: a 122.2 billion ruble campus still under construction, designed in 2021 for up to 82 MW, at least 3,000 racks and up to 120,000 servers, with part of it already running and Russia's largest supercomputer planned for it. Sber's first deputy CEO Alexander Vedyakhin confirmed the attack and said all of Sberbank's systems and services were working normally; the regional governor reported one woman killed in the city, without naming Sber. The drone maker Fire Point claimed the strike on Telegram, taunting that Sberbank was "taking the baton" from Yandex. And for the first time, a named Ukrainian official confirmed a data-center strike outright: presidential adviser Dmytro Lytvyn said the data center was attacked, "and successfully". On the Yandex sites, Kyiv formally remains silent, and nobody had claimed the VK strike as of October 18.

The VK strike followed four nights later. The OSINT project ASTRA geolocated eyewitness videos to Novosergievka, a village on St Petersburg's eastern edge where VK has run its own data center since 2011, next to the 330 kV Vostochnaya electrical substation, which the same videos suggest was hit too. The Leningrad region's governor reported 135 drones downed, four people hospitalized after a house fire caused by falling debris, and some 20,000 residents of neighbouring Yanino without power. He did not mention VK at all; VK did not name the site. The same night, drones set the Petersburg Oil Terminal on fire and closed Pulkovo airport for hours, so the data center was one target among many. That is worth holding onto: this was not a surgical campaign against one cloud, it is a widening one against the buildings Russia's domestic internet lives in.

Did VK's services really run "as normal"?

VK's biggest networks stayed up, so the claim is defensible. It is also not what our measurements show for the network closest to the strike.

In IODA's active probing data, responsive address blocks in VK's St Petersburg network fell about 46% between 3:20 and 3:40 in the morning Moscow time, within an hour of the reported attack, and had not recovered by nine. NetBlocks put VK's connectivity at 56% of ordinary levels. Cloudflare Radar saw a quarter less traffic from the same network than in the same hours a week earlier. The tracker Sboi.rf logged 918 complaints against 571 the day before, peaking between four and six in the morning and coming mostly from St Petersburg, with users reporting messages not sending, media not loading and login failures. VK's BGP routes stayed announced the entire time, with one small Odnoklassniki block the only route still missing hours later. Readers of part one will recognize the signature: routes up, hosts dark, exactly how the Yandex strikes looked and nothing like deliberate censorship. One honest caveat: the neighbouring substation was reportedly hit the same night and a local ISP in the same district went dark for an hour, so public data cannot separate the strike's direct damage from the power cut around it.

Which services sit behind that darkened network matters. Our own resolution of VK's public hostnames on October 18 puts vk.com itself, VK Video and Sferum, the schools platform Russian classrooms are moved onto, on the struck St Petersburg network, while MAX, the state-backed messenger, Odnoklassniki, Mail.ru and Dzen front on VK's Moscow network, which showed no loss. No outage of Sferum or MAX was reported, and a front-end address does not reveal which building the servers stand in. But the company that operates Russia's only whitelisted messenger, both its whitelisted social networks and its school platform has now had a data center burn, and its own statement about it, in the Russian original, was 16 words long.

Where does Yandex Cloud stand a week later?

Nowhere better, and that is the quiet headline of the week. As of October 18 the incident on Yandex Cloud's status page is still open, new resource quotas are still frozen, and the company still names no restoration date. It has made all cloud services in Russian zones free for existing clients from October 8 to 31, and between the second and third strikes it rewrote its user agreement to class drone and missile attacks as force majeure. Consumer apps recovered within days; the cloud did not.

We re-ran the measurements from part one on October 18. Yandex Cloud's network answers from 118 /24 blocks against a pre-strike baseline of 519, which is 77% below normal and a gain of six blocks in a week. The noisy route flapping that had started 16 hours before the first strike ended on October 12 after six days, matching no public event at either end. The one new movement is that on October 17 Yandex Cloud began announcing a fresh block of its own address space, registered back in May; whether that is rebuilding or rehoming, routing data cannot say. Independent estimates put hardware restoration at six months to several years.

How much of the whitelist belongs to these three companies?

Russia's whitelist, the roster of services that stay reachable while mobile internet is cut, has never been published as one official document; the digital ministry releases additions in batches and said in April 2026 it had passed 500 entries. The fullest media compilation names about 175. Count the entries belonging to VK, Yandex and Sber and you get 15, under 9%. That number is honest and completely misleading at the same time.

Misleading, because two of those entries, "Yandex services" and "Mail.ru services", are umbrellas covering dozens of products each. And because the three groups own everything that makes a walled garden feel like an internet: both whitelisted social networks, VK and Odnoklassniki; the only whitelisted messenger, MAX, with some 110 million registered users; the dominant search, mail and maps; the main taxi service; and Sber's consumer brands from Megamarket to Samokat to Domclick. Strip those 15 entries out and the whitelist is mostly government portals, bank sites, telecom operators' own pages, TV channels and a couple dozen glucose-monitor apps. The state's fallback internet is, functionally, three corporations.

Two details sharpen the picture. First, Sberbank's own banking app is not on any published whitelist batch: reporting in early 2026 said the FSB kept out banks that had not installed required surveillance equipment, and the central bank spent the spring asking for all licensed banks to be added. Second, whitelisted services did fail during the strikes. Yandex Taxi failed across the country; complaint trackers logged problems at RZD, MegaFon and Avito on October 8 and at Magnit, Dodo Pizza, Vkusno i tochka, Delimobil and Dom.ru on October 11, all of them names from the whitelist compilations. Whether any of this coincided with an actual whitelist-mode shutdown no public data can say, because outage trackers cannot see those users. What the data does show is that by July 2026, per measurements reported by Kommersant, barely half of mobile sessions in Moscow and its surrounding region ran unrestricted, so the services that failed are the services millions are routinely reduced to.

What about the tools that disguise VPN traffic as calls?

Since late 2025, open-source projects have circulated in Russia that hide VPN traffic inside what the network sees as a video call to a whitelisted domestic platform, VK's call service above all. To filtering equipment the connection looks like call media to an approved Russian address, so it survives whitelist-mode shutdowns that kill ordinary VPN connections. The approach spread through Russian tech forums in a wave of projects in March and April 2026, right after the whitelist regime expanded; their authors describe the technique as fragile and ban-prone, and the tools have repeatedly broken when VK changed verification steps on its call platform, without VK ever saying whether that was the intent. We describe this at category level deliberately: no tool names, no mechanics, and nothing here is a recommendation. As our ledger of Russia's VPN rules documents, the state's published countermeasures so far target VPN users arriving at platforms and rented servers on whitelisted addresses, not these call-shaped routes.

Did the October 18 strike kill that escape route? No, and the mapping is worth stating precisely, because the question writes itself. The call relays such tools ride sit on VK's Moscow network, the one that showed no loss on October 18, and no failures of calls or call tunnels were reported after the strike. The St Petersburg network that went dark hosts VK's main web and login tier instead. So the strike and the tunnels did not touch, this time. The structural point stands anyway: every one of these routes lives inside the server rooms of the same three companies the whitelist lives in, survives at the pleasure of VK's engineers, and now shares their exposure to a drone campaign. An escape hatch cut into the walled garden's own wall burns with the wall.

Does the state see the fragility?

Parts of it do, in writing. Days before the VK strike, a working group of the government's own AI subcommission warned, in a document reported by Forbes, that whitelist filtering can cut cloud platforms off from their own components: backup sites, management systems, storage. That is the bluntest assessment of the regime yet from inside the system: by its logic, a server can be alive and an application running while users simply cannot reach it, and a backup site that cannot be opened from the outside network is no backup at all. The industry council that drafted the proposals, a data-center body whose founders include Yandex Cloud, asked for a protected list of cloud platforms exempt from isolation and a formal procedure for getting on and off the whitelist, which still does not exist. The digital ministry said it was familiar with the position. Neither body mentioned the strikes; they did not need to.

The official response to the strikes themselves, meanwhile, is discussion in both directions and decisions in neither. Digital minister Maksut Shadaev said on October 12 that his ministry and the Defense Ministry were discussing military cover for data centers, and the same day called for stimulating construction in the Urals and Eastern Siberia, naming 42 projects under way and conceding that more than 80% of all resources sit in the Moscow agglomeration. A week on there is no decree, no bill and no announced air defense, only proposals: data centers underground, a "doomsday" backup site, subsidized loans by year-end. The sharpest instrument already on the books is an August presidential decree allowing the state to impose temporary administration over companies judged to have defended themselves poorly against drones, which trade press reads as covering data centers.

And the censors? Untouched, as part one predicted, and tightening. The filtering system sits inside carrier networks, on state-supplied equipment that exists nowhere else, and no strike on a data center touches it. The week's only blocking news points the other way entirely: Kommersant found in a draft national technology plan a target of raising VPN blocking to "95% effectiveness", which the ministry says the current draft no longer contains, sitting next to a filtering-infrastructure budget of nearly 90 billion rubles through 2029.

The bottom line

Russia's whitelist was sold as a backup internet. It is, in practice, the server rooms of three companies wearing a government seal, and in eleven October days all three were hit. The blocking machine lost nothing; the walled garden lost two Yandex Cloud zones, part of a construction site meant to carry Russia's largest supercomputer, and whatever burned in Novosergievka that VK will not describe. Even the one escape route that hides inside the garden's own infrastructure survived only because the drones hit a different building of the same company. For Russian users the lesson of the week is the same as last week's, with two more names on it: every shutdown now hands them a fallback internet that is itself under fire. We track the enforcement side in our reference on every Russian VPN law and block since 2017, the practical side in our report on September's blocking wave, and the country picture on our Russia page.