Adversary Intelligence — 2026-05-08

International Investigation Exposes Secret GRU Cyber Warfare Training Department at Moscow Bauman University

An international investigation published May 7 by The Insider, VSquare, Le Monde, Der Spiegel, and The Guardian drew on over 2,000 leaked documents to identify Department No. 4 at Bauman University's military training center as an unlisted GRU program training hackers and intelligence officers. Curriculum files from the leak show students completing 144-hour courses in server penetration and virus development alongside propaganda coursework requiring covert manipulation techniques and study of CIA, FBI, and NSA operations. The documents show 10 to 15 graduates assigned annually to GRU units including Sandworm and Fancy Bear. Leaked personnel records link lead instructor Lt. Col. Kirill Stupakov to GRU Unit 45807 through July 2025; indicted former Fancy Bear commander Viktor Netyshko signed a February 2024 student evaluation.

Analysis
Per a five-outlet consortium drawing on over 2,000 leaked documents, not independently verified, the reporting closes an evidentiary gap prior attribution had only partially bridged. Stupakov's Unit 45807 assignment through July 2025 and Netyshko's February 2024 student evaluation confirm Department No. 4 remained operationally active well past Russia's 2022 posture shift. Embedding offensive cyber recruitment inside nominally civilian academic infrastructure provides legal cover purely military training cannot. Observable countermeasures within the next 90 days carry a roughly even chance, but any GRU administrative moves would likely be unobservable to outside reporting. The leak may have been selectively seeded to burn specific personnel while leaving more sensitive operational elements intact.

2 sources