The International Consortium of Journalists published an investigative report based on the leak of more than 2,000 internal documents from Bauman’s Moscow State Technical University. They revealed the secret department no. 4, where future agents of the GRU military intelligence service are trained. TASR writes about it according to VSquare and The Guardian servers.
- An international document leak has revealed Bauman University’s secret department number four.
- Officers accused of cyberattacks against Western countries participate in the training.
The study is divided into three specialized groups. The most important one with code 093400 is called Special Investigation Service. The leader is Lt. Col. Kirill Stupakov, who, according to the investigation, commanded GRU unit 45807 until July 2025. It is unclear whether he is still on active duty.
Criticism of the country’s leadership
Internal evaluations portray him as an exemplary officer. According to telegram chats analyzed by Der Spiegel, he is critical of the country’s leadership and has a pessimistic view of the war against Ukraine: he complains of heavy losses and predicts that the war will “end badly for us.”
Intelligence officers connected with international cybercrime are involved in the training. For example, the former commander of Unit 26165, General Viktor Netyško, was indicted in the US for interfering in the 2016 presidential election and hacking the Democratic Party’s data. Yuriy Shikolenko is subject to UK sanctions for organizing cyber attacks and Dmytro Velykorodnyi is a radiological, chemical and biological defense specialist.
Participation in hacker attacks
Journalists described the story of student Daniil Poršin, who joined the 26165 GRU unit after graduating in 2024. It is also known as the FancyBear hacker group or APT28. In 2015, she was accused of hacking TV5 Monde to broadcast jihadist propaganda, the emails of Emmanuel Macron’s election team and also institutions linked to the organization of the 2024 Paris Olympics.
The curriculum includes, for example, Pentagon network architecture, working with exploitation tools (Metasploit), developing viruses and Trojan horses, organizing DDoS attacks, courses in experimental psychology, creating manipulative content for social media and information warfare strategies.
GRU espionage technologies
The courses include eavesdropping, using microphones and installing mini cameras in household appliances or detecting eavesdropping devices using the Russian ST-031 Piranha system. However, internal reports by GRU officers point to, for example, a lack of ability to carry out a remote network attack.
However, one of the smart students strengthened unit 74455 in the Black Sea city of Anapa, known to Western intelligence as Sandworm.
False identities in the West
The investigation also revealed the practice of changing one’s identity before graduation. In March 2024, Ivan Makarov (associated with hacker unit 26165) officially changed his name to Mark Fisher and received a corresponding set of new documents. This suggests that he could be sent to the West under a false identity.
Le Monde, Der Spiegel, The Insider, The Guardian, VSquare and Delfi participated in the investigation. Neither the university nor its teachers and students mentioned in the investigation responded to requests for comment.
