Yandex (Vendor): news timeline & CVEs

No click required: How the ad industry became a pipeline for mercenary spyware

Citizen Lab says Discover-Tech used ad auctions to profile devices and deliver Candiru spyware without a click.

The Citizen Lab says Discover-Tech used its Controlium advertising platform, described as AdFection, to win real-time ad auctions, fingerprint devices, and silently deliver exploit code when an ad rendered. Over four months its ads appeared on about 120,768 websites and in 75,373 apps, including impressions on networks associated with NATO and major technology companies; an impression alone is not an infection. Israeli mercenary-spyware vendor Candiru used the path to infect devices at Al Jazeera. Google, IAB Europe, Beeswax, Vungle, and Eskimi removed Discover-Tech’s access after disclosure.

CSO Onlineupdated Oct 16, 17:20 UTC · 11h agofirst Oct 16, 01:02 UTC · 1d agoMalware in the wild 12 sources1· 1 read

Targeted ads delivered 0-click exploits to install mercenary malware

Citizen Lab says Discover-Tech ads delivered Candiru zero-click exploits that installed mercenary spyware.

Citizen Lab reported the AdFection campaign, in which Discover-Tech served targeted ads that delivered zero-click exploits and installed mercenary spyware from Candiru, also known as Integrity Labs. Ad code contacted Candiru servers, which returned an exploit and payload when the ad rendered. Google, IAB Europe, Beeswax, Vungle, and Eskimi have since removed, paused, or blocked Discover-Tech. Impressions appeared on networks linked to NATO, the United Nations, European lawmaking bodies, Australian critical infrastructure, and Norwegian and Swedish government and military agencies. The report does not name the vulnerabilities or the final malware.

Ars Technica · Securityupdated Oct 16, 17:20 UTC · 11h agofirst Oct 15, 20:32 UTC · 1d agoThreat actor in the wild 12 sources

Zero-click spyware infecting devices through online ads, researchers say

Citizen Lab says Candiru used Discover-Tech ads to zero-click infect Al Jazeera journalists and reach sensitive government networks.

Citizen Lab and Confiant say Israeli ad firm Discover-Tech used its Controlium platform to deliver zero-click spyware through online ads. The ads infected devices of at least 45 Al Jazeera journalists and were rendered on sensitive networks including NATO, the U.S. Department of Defense, Estonia’s RIA, the IAEA, and the ICC. Candiru allegedly hired Discover-Tech; the ads sent millions of devices to Candiru servers and the spyware can record calls, enable microphones, and steal messages. Researchers reviewed four billion placement records, and Google and other platforms have since blocked Discover-Tech.

The Recordupdated Oct 16, 17:20 UTC · 11h agofirst Oct 15, 19:00 UTC · 1d agoThreat actor in the wild 12 sources2

Data Centers Are War Targets Now

Ukrainian drones struck Russian Yandex and Sberbank data centers, disrupting everyday digital services across Russia.

404 Media reports that Ukrainian drones struck Russian data centers, including a fourth attack in a week against a Sberbank facility after earlier hits on Yandex sites. President Zelenskyy confirmed strikes on data centers and oil refineries. Three Yandex strikes damaged supercomputers that housed some AI models, took two of the company's six Russian data centers offline, and disrupted email, cloud services, taxis, and commercial logistics. The article also cites Iran's March strikes on AWS facilities in Dubai and a legal researcher on dual-use targeting, proportionality, and civilian harm.

404 MediaOct 15, 13:00 UTC · 1d agoPolicy & legal 11 sources2· 1 read

Srsly Risky Biz: Russia's Digital Detox Boomerang

Ukrainian strikes on Yandex data centers disrupted Russian cloud, payments, and apps after Moscow hit Ukrainian sites.

Risky Business reports that Ukrainian drone strikes on Yandex data centers disrupted Russia's largest domestic digital platform after Moscow's conventional attacks on Ukrainian data centers and Kyivstar, which the Russian Ministry of Defense called a "digital detox." Yandex, which combines search, cloud, payments, maps, taxis, and delivery, saw three of its six largest centers hit; cloud customers and Yandex Pay users faced outages, while the company said funds remained safe but gave no restoration time. Russia's data-localization and sovereignty rules leave most capacity inside the country, and a Bremen University researcher said 95 percent of Russian data centers are within Ukrainian drone range. The piece contrasts Ukraine's faster shift of critical services to EU sites and Microsoft, Amazon, and Starlink, and briefly previews an Anthropic report on how easily open-weight model safeguards can be removed.

Risky Business Newsupdated Oct 15, 13:00 UTC · 1d agofirst Oct 15, 04:11 UTC · 2d agoIndustry 11 sources

Yandex outage: Data shows that instead of going dark, malicious bots went on the move

Cloudflare says Yandex outages cut search crawling while malicious cloud bots mostly moved elsewhere.

Cloudflare analyzed traffic after reported Ukrainian drone strikes on Yandex facilities between October 7 and 11. On October 11, Yandex Search (AS13238) fell about 99% below baseline and Yandex.Cloud (AS200350) about 90%. Search losses were almost entirely verified crawlers, including YandexBot, while Yandex.Cloud's unverified bots showed sharp drops in WordPress plugin probing and scanner traffic. Global bot share stayed near 39%, and Cloudflare says high-volume malicious automation largely moved to other hosts rather than disappearing.

Cloudflare Blogupdated Oct 15, 13:00 UTC · 1d agofirst Oct 14, 20:24 UTC · 2d agoResearch 11 sources2

Yandex Data Center Outage Disrupts Access to Cloud Files Following Drone Attack

Drone strikes damaged three Yandex data centers in Russia, disrupting cloud files and Yandex Cloud.

Yandex said drone strikes damaged three Russian data centers between October 7 and 11, 2026. The Sasovo site and the Vladimir site stopped operating, while Kaluga lost part of its infrastructure; no injuries were reported. Yandex Disk users saw failed downloads and HTTP 302, 500, and 504 errors, and Yandex Cloud ran in emergency mode with partial compute, AI Studio, and security services and Monium offline. The company gave no restoration timeline, urged alternate disaster-recovery plans, and reporting did not establish malware, stolen credentials, or unauthorized access.

Cyber Security Newsupdated Oct 15, 13:00 UTC · 1d agofirst Oct 13, 03:28 UTC · 4d agoIndustry 11 sources3· 2 reads

Yandex confirms service outage as users lose access to cloud files

Drone strikes knocked out Yandex data centers, cutting customers off from cloud files and services.

Yandex said drone attacks damaged data centers in Sasovo (October 8), Kaluga (October 9), and Vladimir (October 11), fully shutting Sasovo and Vladimir and degrading Kaluga. Customers cannot reliably download Yandex Disk files, reporting HTTP 302, 500, and 504 errors and backups missing thumbnails. The company, whose cloud supports much of Russia’s government and business internet, called remaining capacity unstable and told customers to use alternative disaster-recovery infrastructure. No injuries were reported, permanent data loss is unconfirmed, and services such as Console, API, S3, and Kubernetes remain only partly available while Monium is offline.

BleepingComputerupdated Oct 15, 13:00 UTC · 1d agofirst Oct 12, 19:23 UTC · 4d agoIndustry 11 sources1

Russia was not ready for the data center war it started with Ukraine

Ukrainian drones struck Yandex data centers near Moscow, disrupting payments, cloud, and other Russian digital services.

Ukrainian drone strikes on October 9 and October 11 knocked out Yandex data centers in Russia's Kaluga and Vladimir regions, including a 63-megawatt facility and the site of the Galushkin supercomputer. Galushkin ranked 134 on the Top500 list at 20.64 petaflops. Reported disruptions hit Russian payment and banking apps, email, e-commerce, streaming, ride-hailing, maps, Yandex search, and Yandex Cloud customers. Commentators cited Yandex's centralized infrastructure and Russia's 2019 Sovereign Internet Law as limits on wartime backup.

Ars Technica · AIupdated Oct 15, 13:00 UTC · 1d agofirst Oct 12, 17:52 UTC · 4d agoOther 11 sources1

Ukrainian drone strikes on Yandex datacenters knock cloud and payments offline

Ukrainian drone strikes on three Yandex datacenters knocked Yandex Cloud and Yandex Pay offline.

Ukraine struck three of Yandex's five Russian datacenters with drones between October 7 and October 9, taking parts of the company's cloud and payments stack offline. The Sasovo site was seriously damaged and fully shut down, Kaluga lost some infrastructure, and a later strike hit the Vladimir site that supports Yandex Pay. Fintech head Dima Pirogov said customer money is safe but gave no restoration timeline. NetBlocks reported Yandex Cloud connectivity at about 30 percent of normal on October 11, while engineers prioritized Alice, Mail, Maps, Search, and Taxi.

The Register · Securityupdated Oct 15, 13:00 UTC · 1d agofirst Oct 12, 13:45 UTC · 4d agoIndustry 11 sources2

Ukraine hits Russian Datacentre causing a 29% drop in US Twitter posts

Ukrainian drone strikes on Yandex data centers disrupted Russian online services and sharply cut Yandex-linked bot traffic.

The London Economic reports that Ukrainian drone strikes hit Yandex data centers in Russia and took major online services offline. Monitors said residents could not use banking apps, complete transactions, or book taxis, while automated traffic from Yandex's network fell to about 0.4% of its recent peak. French researcher David Colon said Storm-1516 false narratives then received only dozens of impressions instead of millions of views. President Zelensky said the strikes reduced bot-driven hate and provocations on social platforms.

Hacker News · securityupdated Oct 15, 13:00 UTC · 1d agofirst Oct 12, 13:06 UTC · 4d agoThreat actor 11 sources HN 20↑ · 9 comments1

Yandex bot traffic down 99% after data center attack

Yandex bot traffic fell about 99% after a reported data center attack, per Cloudflare Radar.

A Hacker News post points to Cloudflare Radar for AS13238, where Yandex bot traffic is shown down about 99% over seven days after a reported data center attack. The item itself only notes 54 points and 7 comments and does not name an attacker, malware, CVE, or confirm data theft or ransomware. The visible impact is a near-total collapse of Yandex bot traffic rather than a documented breach.

Hacker News · securityupdated Oct 15, 13:00 UTC · 1d agofirst Oct 12, 04:54 UTC · 5d agoIndustry 11 sources HN 54↑ · 7 comments1

3rd Yandex Cloud Data Center Was Hit

A Hacker News report says a third Yandex Cloud data center was hit.

A Hacker News security thread points to Yandex Cloud status incident 2136 under the headline that a third Yandex Cloud data center was hit. The supplied text only notes 48 points and 30 comments and does not describe the cause, affected services, or whether customer data was accessed. Impact should be treated as unconfirmed beyond the reported data-center incident.

Hacker News · securityupdated Oct 15, 13:00 UTC · 1d agofirst Oct 11, 07:34 UTC · 5d agoData breach 11 sources HN 48↑ · 30 comments2

Yandex Takes a Second Data Center Hit in 48 Hours

A drone strike took Yandex’s Kaluga data-center modules offline, the company’s second Russian site hit in 48 hours.

Russian state media TASS reported on October 9 that a drone strike put several modules of Yandex’s Kaluga data center completely out of service. The Grabtsevo industrial-park site, described as Yandex’s largest in Russia, covers about 130,000 square meters, was planned for 63 megawatts, and can hold more than 3,800 server racks. It supports Yandex internal services and Yandex Cloud. The strike was the company’s second data-center hit in 48 hours, after damage at its Sasovo facility in Ryazan.

Hacker News · securityOct 9, 14:20 UTC · 7d agoOther HN 23↑ · 6 comments1· 1 read

Yandex Introduces Sona: A Single Generative Recommender That Replaces Entire Recommendation Cascade

Yandex's Sona transformer replaced Music's recommendation cascade and lifted likes 11.42% in testing.

Yandex introduced Sona, a single generative recommender that uses one transformer for both candidate generation and ranking instead of a multi-stage cascade. In a Yandex Music A/B test it operated without hand-engineered features and increased likes by 11.42%. The announcement does not report parameter counts or comparisons beyond that test.

MarkTechPostOct 5, 08:10 UTC · 11d agoAI research2· 1 read

Yandex

Timeline15 articles

Appears with