Full Report
Russia’s losses from Ukrainian strikes on oil refineries have already reached 1% of GDP — and that's if Vladimir Putin is to be believed. Putin, of course, is hard to believe, but even 1% of GDP is an enormous sum — roughly half of the federal government's current budget deficit. And on top of that, mounting strikes mean the figure is likely only to rise — especially if the three recent attacks on Yandex data centers signal a new trend. According to The Insider’s estimates, each successful strike on an oil refinery costs Russia an average of around 23 billion rubles ($274 million), while a strike on an online marketplace warehouse costs 450,000 rubles ($5,350) per square meter. In the long run, these losses will weigh on the budget and drive down consumer demand — two key drivers of the Russian economy.
Analysis Summary
# Incident Report: Multi-Sector Kinetic Drone Campaign Against Russian Infrastructure
## Executive Summary
A sustained campaign of long-range Ukrainian drone strikes has targeted critical Russian economic infrastructure, specifically focusing on oil refineries, online marketplace warehouses, and Yandex data centers. The campaign has resulted in estimated losses equivalent to 1% of Russia's GDP, causing significant financial strain on both the federal budget and private sector operations.
## Incident Details
- **Discovery Date:** Ongoing (Reports current as of October 14, 2026)
- **Incident Date:** 2024 – late 2026
- **Affected Organizations:** Yandex, Wildberries, Ozon, Rosneft, Gazprom Neft, and various secondary-processing refineries.
- **Sector:** Energy (Oil & Gas), E-commerce/Logistics, Information Technology.
- **Geography:** Russia (Omsk, Syzran, Moscow, and various warehouse/data center locations).
## Timeline of Events
### Initial Access
- **Date/Time:** Campaign intensified throughout 2024 and 2026.
- **Vector:** Kinetic aerial strikes via Unmanned Aerial Vehicles (UAVs/Drones).
- **Details:** Drones bypassed regional air defense to strike high-value economic targets.
### Lateral Movement
- **N/A:** As this is a kinetic/physical attack campaign, movement refers to the geographic expansion of strike zones targeting different industrial sectors (Refineries → Warehouses → Data Centers).
### Data Exfiltration/Impact
- **Oil Sector:** Destruction of primary and secondary processing units (e.g., ELOU-AVT-6).
- **E-commerce:** Physical destruction of goods and logistics hubs.
- **IT/Services:** Impairment of data center operations (Yandex), affecting digital infrastructure.
### Detection & Response
- **Detection:** Visual sighting of drones, radar detection, and immediate post-impact explosions/fires.
- **Response Actions:** Firefighting, emergency refinery shutdowns, and attempts to source replacement components via "import substitution" or Asian suppliers.
## Attack Methodology
- **Initial Access:** Long-range drone incursions.
- **Impact:** Kinetic destruction of specialized industrial equipment.
- **Defense Evasion:** Low-altitude flight paths to evade radar; saturation of air defense systems.
- **Discovery:** Selection of targets based on economic significance (High-GDP contributors).
## Impact Assessment
- **Financial:**
- Total losses estimated at 1% of GDP (approx. half of the federal budget deficit).
- Oil Refinery Strike: ~23 billion rubles ($274M) per successful hit.
- Warehouse Strike: ~450,000 rubles ($5,350) per square meter.
- **Data Breach:** N/A (Physical destruction of hardware in data centers rather than data theft).
- **Operational:** Refineries face 6-month minimum downtimes for overhauls; logistics chains for marketplaces disrupted.
- **Reputational:** Decreased consumer confidence and strain on the "Russian economic model."
## Indicators of Compromise
- **Physical Indicators:** Low-flying UAVs, thermal signatures of fires at industrial sites.
- **Economic Indicators:** Sudden drops in fuel production, spikes in consumer goods prices, and budget deficit expansion.
## Response Actions
- **Containment:** Emergency fire suppression and localized shutdowns of damaged units.
- **Eradication:** Deployment of electronic warfare (EW) and mobile anti-aircraft units around high-value targets.
- **Recovery:** Attempted procurement of refining units via non-sanctioned markets (predominantly Asian suppliers).
## Lessons Learned
- **Key Takeaways:** Economic concentration in a few large refineries (37 major sites) creates a "single point of failure" vulnerability.
- **Supply Chain Vulnerability:** Sanctions significantly prolong recovery times because specialized oil-refining equipment cannot be easily replaced by domestic alternatives.
## Recommendations
- **Physical Security:** Increase deployment of point-defense anti-drone systems (C-UAS) at all critical energy and IT hubs.
- **Redundancy:** Decentralize logistics hubs and data center clusters to prevent single strikes from causing systemic consumer disruption.
- **Strategic Reserve:** Maintain a stockpile of critical long-lead components for oil processing to mitigate the 6-month repair window.