Russian drones strike Ukraine’s data centers by exploiting air defense gaps

Listen to this article

Narrated by Charlotte · The Noble House

Strategic Escalation Against Digital Infrastructure

On September 23, Russian Geran-5 jet-powered drones struck an office building in Kyiv’s Solomianskyi district housing key internet backbone nodes, and about 100,000 households in Kyiv and the surrounding region lost internet service [2]. The attacks add data centers and communications networks to a broader long-range strike campaign that has also hit Ukraine’s power grid, railways and ports, and that Russia has intensified in recent weeks [1]. By exploiting gaps in Ukraine’s air defenses, Russian drones reached facilities whose destruction silenced the internet-delivered air raid alerts [2].

The operational success of this escalation relies on the technological superiority of the Geran-5 platform. Unlike its propeller-driven predecessors, the jet-powered variant achieves speeds up to 600 kilometers per hour and operates at altitudes that complicate engagement by Ukrainian air defense systems [2]. Zelenskyy said on October 4 that Ukrainian air defenses intercept more than 85 percent of conventional Shahed-type drones, but only 50 or 60 percent of the newer, faster jet-powered Shahed drones [1]. The Geran-5 carries a 90-kilogram warhead and utilizes a Telefly jet engine, enabling speeds of up to 600 km/h and cruising altitudes up to 6,000 meters, which makes it significantly harder for Ukrainian air defenses and interceptor drones to engage than its slower predecessors [2].

The timing of this escalation coincides with broader battlefield dynamics, including Ukrainian military gains in eastern regions. Russia’s intensified strike campaign coincides with battlefield setbacks, including the Ukrainian military’s recapture of territory near the fortress belt cities in eastern Ukraine, and the campaign arguably represents the main avenue left for Moscow to claim some semblance of victory [1]. The destruction of data centers serves a dual purpose: it disrupts essential services for the population and silences the very mechanisms used to warn civilians of incoming threats. The Institute for the Study of War assesses that the wider long-range strike campaign aims to make civilian life in Ukraine unbearable so that Ukraine will capitulate to Russia’s demands, and that Russia seeks to exploit Ukraine’s current air defense gaps to damage or destroy infrastructure during the colder fall and winter seasons [1].

Compass Predictive Analytics

Signal gauge

68%

Evidence Reliability

8 Of 8 Validated Assertions Have Complete Exact Span And Ownership Lineage. · Positive

tracked

Quantifies the conservative evidence floor after exact-span and independent-owner checks.

8 evidence references

Signal gauge

97%

Evidence Freshness

Evidence Freshness Is 97 For The Selected Signal. · Positive

tracked

Separates current evidence from aging context using a declared decay window.

8 evidence references

Russian Geran-5 drones struck a Kyiv business center housing critical internet exchange points, severing connectivity for 100,000 households and silencing air raid warnings. — Illustration: Russian Geran-5 drones struck a Kyiv office building housing key internet infrastructure on September 23, disrupting service for about 100,000 households.

Impact on Civilian Connectivity and Emergency Services

The immediate consequence of these strikes has been a severe degradation of internet and mobile phone services for hundreds of thousands of residents. Following the September 23 attack, approximately 100,000 households in Kyiv and Kyiv Oblast experienced internet outages [4] [7]. The disruption was not limited to a single provider but affected multiple major telecommunications companies, including Pavutyna, UTELS, and Crazy Network, which suffered physical damage to their core equipment and exchange points [2]. This widespread failure illustrates the fragility of interconnected digital infrastructure when central nodes are targeted.

Beyond general connectivity loss, the strikes have critically impaired Ukraine’s air raid warning system. The national alert mechanism combines outdoor sirens with internet-delivered push notifications via smartphone applications and messaging platforms like Telegram, and most residents receive warnings through the internet-delivered channel [2]. When data centers housing the core routing equipment for these providers are destroyed, the digital layer of the warning system fails. This creates a dangerous feedback loop where civilians are denied access to life-saving information about the very attacks that caused the outage [2]. Foreign Minister Andrii Sybiha emphasized that this disruption endangers lives by preventing rapid alerts from reaching those who need them most [6].

The human toll of these infrastructure strikes extends beyond digital isolation. A separate Russian drone strike on Friday hit a Kyiv business center housing a Datagroup data center, killing four people and damaging the facility, though Datagroup said its services continued to operate from backup sites [5]. The physical destruction of facilities housing critical network hardware means that restoration requires not just software reconfiguration but the rebuilding of physical assets under continued threat of attack [2]. Providers can limit the impact of strikes by duplicating equipment and distributing infrastructure, including outside Ukraine, but that is expensive, and smaller ISPs in particular cannot afford to duplicate their core equipment, leaving them with no fallback when the building housing it is destroyed [2] [4]. The distinction between cyber warfare and kinetic destruction is crucial here: a cyberattack can temporarily knock a network offline, but a Geran-5 carrying a 90-kilogram warhead can permanently destroy the physical servers, switching equipment, and fiber termination points the network ran on [2].

Compass Predictive Analytics

Signal gauge

100%

Independent Source Breadth

Independent Source Breadth Is 100 For The Selected Signal. · Positive

tracked

Shows how many genuinely independent owners support the evidence after syndication collapse.

8 evidence references

Signal gauge

71%

Observed Source Diffusion

70 Observed Sources Resolve To 20.462586 Effective Sources. · Neutral

tracked

Separates broad source participation from concentration in a few high-volume sources.

8 evidence references

A resident checks her phone for air raid alerts as smoke rises from a business center housing critical internet infrastructure in Kyiv.

Technical Mechanisms and Air Defense Vulnerabilities

The effectiveness of the Russian campaign is rooted in the specific technical capabilities of the Geran-5 drone and the corresponding limitations of Ukrainian air defense. The Geran-5 carries a 90-kilogram warhead and utilizes a Telefly jet engine, enabling speeds of up to 600 km/h and cruising altitudes up to 6,000 meters, which makes it significantly harder for Ukrainian air defenses to engage than its slower predecessors [2]. This technological advantage helps the drones reach deep into urban centers like Kyiv.

Ukraine’s air defense inventory has been further strained by the exhaustion of its supply of missile interceptors throughout the conflict year [1]. The inability to maintain high interception rates against jet-powered threats has created exploitable gaps in the airspace over critical infrastructure zones. Russian forces have leveraged these gaps to conduct repeated strikes on co-location data centers, which serve as internet exchange points where multiple ISPs peer their networks [2]. By destroying a single building that houses equipment for several providers, Russia can simultaneously terminate connectivity for numerous networks, amplifying the impact of each individual strike [2].

The distinction between cyber warfare and kinetic destruction is crucial to understanding the severity of this phase. While cyberattacks can temporarily disrupt network services, they do not physically eliminate the hardware required to restore them. In contrast, the Geran-5’s warhead can permanently destroy servers, switching equipment, and fiber termination points [2]. This physical elimination forces providers to undertake costly and time-consuming reconstruction efforts, often while under fire.

Compass Predictive Analytics

Analytic module

module

Signal Pressure Matrix

Validated independent claim-owner cells resolve to 8 support and 0 risk pressure.

8 evidence references

Analytic module

module

Evidence Density

8 source links, 8 exact spans, and 8 independent owners support this signal.

16 evidence references

Illustration: Damage to a Kyiv business center housing critical internet infrastructure illustrates the physical destruction of civilian digital lifelines by high-speed drone strikes.

Strategic Implications and Future Trajectory

The targeting of data centers represents a significant escalation in Russia’s hybrid warfare tactics, aiming to degrade Ukraine’s digital sovereignty and emergency response capabilities. The Russian Defense Ministry has claimed responsibility for strikes on Kyiv data centers it says served Ukraine’s military and security agencies, including New-Telco and United DC, and for targeting the data center of Vodafone Ukraine [3] [4]. Those claims about military use could not be independently verified, and Ukraine’s foreign minister rejected them, calling the facilities critical civilian infrastructure and not a military target [4]. Under Additional Protocol I of the Geneva Conventions, an object normally used for civilian purposes must be presumed civilian unless there is specific evidence it constitutes a military objective [2].

Ukraine’s response has included accelerating efforts to decentralize its digital infrastructure. The government has invested in moving data centers abroad and building underground networks to reduce vulnerability to aerial strikes [3]. However, former deputy minister of defense Kateryna Chernohorenko cautioned that not all infrastructure can be moved underground and emphasized the urgent need for enhanced anti-ballistic and counter-drone capabilities [3]. The maintenance delays affecting Ukraine’s F-16 fleet, with some jets requiring up to 40 weeks for service in Belgium, further complicate efforts to secure airspace against high-speed threats [3].

The long-term implications of this campaign suggest a continued degradation of civilian life and economic stability in Ukraine. Ukrainian officials have acknowledged that the cost of internet services could increase to cover the cost of repairs [5]. Furthermore, the silencing of air raid alerts poses a persistent risk to civilian safety, as residents may remain unaware of incoming threats due to network failures. The International Criminal Court has already opened investigations into Russian strikes on civilian infrastructure that disrupt air warning services, indicating that these actions may constitute war crimes under international law [2].

Compass Predictive Analytics

Analytic module

module

Cross Pressure

Support and risk pressure differ by 100 points.

8 evidence references

Analytic module

module

Statistical Surprise

The current share has a modified-Z score of -1.054731 and is classified within reference range.

8 evidence references

The disruption of digital infrastructure has silenced air raid warnings for hundreds of thousands in Kyiv, leaving residents isolated and unaware of incoming threats. — Illustration: Strikes on Kyiv data centers disrupted internet-delivered air raid alerts for users of the affected providers.

Conclusion

The Russian campaign against Ukraine’s data centers is part of a broader long-range strike campaign that seeks to exploit air defense gaps and make civilian life in Ukraine unbearable [1]. By deploying high-speed Geran-5 drones against data centers and internet exchange points, Moscow disrupted internet service for approximately 100,000 households in Kyiv and the surrounding region and silenced internet-delivered air raid notifications [2]. This dual impact undermines both the economic functionality of Ukraine’s digital economy and the immediate safety of its population.

While Ukraine has implemented measures such as geographic redundancy and underground infrastructure to mitigate these risks, the cost and logistical complexity of such defenses remain significant hurdles [3]. Ukrainian air defenses intercept only 50 or 60 percent of the newer jet-powered drones, against more than 85 percent of conventional Shahed-type drones [1]. Russia’s strategy seeks to exploit these air defense gaps during the colder fall and winter seasons [1].

The judgment here is that Russia is exploiting a real weakness in Ukraine’s defensive posture: the dependence of civilian communications, and of the internet-delivered layer of the warning system, on a small number of physically exposed buildings. Russia’s Defense Ministry says the targets served Ukraine’s military, but those claims could not be independently verified. So far the strikes have caused significant but scattered outages rather than a nationwide blackout, and providers with backup sites or offshore redundancy have kept services running [4]. Unless Ukraine can strengthen its air defenses or further decentralize its infrastructure, further disruption remains a real risk as the colder months approach [1].

Compass Predictive Analytics

Analytic module

module

Observed Source Diffusion

70 sources produce 20.462586 effective-source breadth with HHI 0.091064.

8 evidence references

Russian drones strike Ukraine’s data centers by exploiting air defense gaps

Strategic Escalation Against Digital Infrastructure

Impact on Civilian Connectivity and Emergency Services