I have a web application that the Yandex spider is trying access into back-end a few times. After these spider searching, there are few Russian IP addresses that try to access back-end too and they failed to access. 

Should I block Yandex or take another action?

Update:

The Yandex spider visits a back-end URL about once per 2-3 day. We did not release any back-end URL at the front-end.

The "back-end" meanings:
the web application's interface just allowing our administrative to manage the application


  Should i block Yandex


Why?
First, if the bot is a legitimate search engine bot (and nothing else), they won't hack you. If not, blocking a User agent won't help, they'll just use another one.
If your password is good, fail2ban is configured, the software is up to date etc., just let them try. If not, you need to fix that, independent of any Yandex bots.  

To make sure the problem is actually Yandex, try disallowing it in robots.txt and see if it stops.
No => not Yandex. 

(Did set up a new webserver some weeks ago. One hour after going online, had not even a domain yet, a "Googlebot" started trying SQL injections for a non-existent Wordpress. It was fun to watch, as there were no other HTTP requests. But I did not block Google because of that.) 
