Russian University’s Secret Department Training Hackers for Military Intelligence, Investigation Reveals

Russian University Operates Covert GRU Training Program for Cyber Warfare, Investigation Reveals

A major international investigation has uncovered evidence that Bauman Moscow State Technical University functions as a de facto training ground for Russia’s military intelligence agency, the GRU, preparing students for roles in cyber warfare and information operations targeting Western countries.

The investigation, conducted jointly by The Guardian, Der Spiegel, Le Monde, The Insider, Delfi, and VSquare, analyzed over 2,000 internal university documents spanning through 2025, including training programs, lecturer contracts, examination materials, and graduate placement records.

These documents reveal the existence of “Department No. 4,” also known as “Special Training,” which operates within the university’s military training center. The department’s most significant program carries the code 093400 and is titled “Special Intelligence Service,” functioning as a direct pipeline to Russian intelligence agencies.

According to a former high-ranking Russian Ministry of Defense official interviewed by the journalists, the system works as a “conveyor belt,” identifying promising candidates at a young age before guiding them through Bauman University and ultimately into specialized units within Russia’s security apparatus.

The department is headed by Lieutenant Colonel Kirill Stupakov, an electronic intelligence specialist who signed a contract with GRU military unit No. 45807 in 2022. Stupakov’s teaching materials show students learn sophisticated surveillance techniques, including the use of hidden cameras disguised as everyday objects and methods for intercepting electronic communications.

Perhaps most notably, the faculty includes Major General Viktor Netyksha, whom Western intelligence agencies have identified as a leader of the infamous Fancy Bear hacking group. This GRU-affiliated unit has been implicated by U.S. authorities in the 2016 presidential election interference campaign.

The curriculum is extensive and technically advanced. One core 144-hour course titled “Protection Against Technical Intelligence” teaches students network attack methodologies, software vulnerability exploitation, password cracking, and malware development. To pass the course, students must demonstrate practical network attack skills and independently develop computer viruses.

Beyond technical training, the program includes significant components focused on information warfare and psychological operations. Senior students must complete seminars on developing disinformation campaigns, creating manipulative social media content, and employing psychological pressure tactics to influence target audiences.

The investigation found that teaching materials consistently reflect official Kremlin narratives regarding the war in Ukraine, describing the invasion as “inevitable” and repeating claims about “nationalists and neo-Nazis” in Kyiv.

Perhaps most concerning for Western security agencies is the document trail showing where graduates are placed after completing their studies. Among the 69 students who graduated in 2024, the journalists identified Daniil Porshin, a top student who was assigned directly to the Fancy Bear unit. Another 15 graduates from the same class were also placed in various GRU structures.

One graduate was sent to military unit No. 74455 in Anapa on the Black Sea coast, believed to house the notorious Sandworm hacking group. This unit has been linked to several high-profile cyber operations, including the 2015 Ukrainian power grid attack, hacking operations targeting Emmanuel Macron’s campaign before the French elections, disruption of the Winter Olympics in South Korea, and interference with the Salisbury poisoning investigation.

The selection process appears rigorous, with GRU representatives directly controlling student admissions, administering exams, and making final placement decisions. Not all students make the cut—records show critical assessments from GRU evaluators, with one student criticized for “insufficient understanding of how to conduct a remote network attack.”

Security analysts view this program as part of Russia’s broader strategy to develop long-term capabilities for hybrid warfare against Western targets. According to the documents, the next cohort of cyber operatives will complete their training in 2027, suggesting a continued investment in these capabilities.

Sources close to the investigation indicate that Bauman University may represent just one component of a larger educational network feeding talent into Russian intelligence services. They suggest that MIREA University in Moscow plays an even more significant role in training future hackers and intelligence officers.

This revelation comes amid growing concerns about increasing Russian cyber operations targeting critical infrastructure in Europe and the United States.