Adversary Intelligence — 2026-09-03

Leaked Bauman University Records Expose GRU Cyber Training Pipeline Linking Graduates to Sandworm and Military Intelligence Units

BLUFBauman's Department No. 4 pipeline confirms GRU cyber units replenish through institutional recruitment Western indictments cannot reach, making operator attrition an unreliable disruption mechanism.

Leaked internal records from Bauman Moscow State Technical University describe Department No. 4, a concealed unit within the university's Military Training Center that prepared roughly 250 career and reserve students for GRU-linked service, according to DomainTools Investigations (DTI), which reviewed material circulated on the DarkForums RU forum 1. The leak was first exposed in a May 2026 investigation by an international media consortium (The Insider, VSquare, The Guardian, Le Monde, Der Spiegel, Delfi Estonia, FRONTSTORY.PL) using roughly 2,000 internal documents, which found 10-15 students assigned annually to GRU units under direct GRU-officer supervision, three months before DTI's independent technical analysis. DTI reports that graduates were assigned to Military Unit 26165, tied to APT28, and Unit 74455, tied to Sandworm, and that former Unit 26165 commander Viktor Netyksho, indicted in the US in 2018 over the 2016 election hacking, is linked to student oversight via a signed February 2024 department letter 1. Schneier on Security separately reported that a 2024 Department No. 4 graduate, Aleksei Kondrashov, was linked to Unit 74455, cautioning that reported unit placements are not proof of individual operational involvement 2. DTI's metadata analysis of roughly 1,600 leaked files traces their origin to Bauman's administrative systems; the method of exfiltration remains undetermined 1.

Analysis
Leaked Bauman's records shift the analytic frame from named APT brands to an institutional pipeline generating Units 26165 and 74455 personnel on a repeatable basis, meaning Western indictments, including Netyksho's, who remains tied to student oversight, have not disrupted GRU recruitment practices. Sourcing traces to a single primary investigation, the VSquare-led consortium, with DomainTools' metadata review of roughly 1,600 files and Schneier on Security's summary serving as corroborating rather than independent confirmation; that forensic review newly verifies the leak originated within Bauman's own administrative systems, though the exfiltration method remains undetermined, leaving open whether those systems stay compromised and whether further cohort data could surface. The leak's thin distribution trail, a barely active forum account with a single post, is equally consistent with a curated disclosure by a state or activist actor as with an opportunistic breach. The largest cyber-effects training stream, VUS 141600, has drawn comparatively little scrutiny despite producing the broadest operational cohort.

3 sources

Threat Intelligence Report: University Leak Exposes Russia's Military Cyber Training Pipeline - DomainTools Investigations
Leaked Russian Cyber-Operations Training Materials - Schneier on Security
Welcome to the GRU University, Where Moscow Turns Students into Spies and Hackers - VSquare.org (in consortium with The Insider, The Guardian, Le Monde, Der Spiegel, Delfi Estonia, FRONTSTORY.PL)