A cache of 2,000 internal documents obtained by an international media consortium has revealed that the prestigious Bauman Moscow State Technical University operates a clandestine faculty. Known as Department 4, or "Special Training", this unit is dedicated to preparing students for careers within the GRU, Russia’s military intelligence directorate.[1]
While President Vladimir Putin recently visited the campus to discuss lunar missions, the secretive role of this department in training cyber operatives remained excluded from the official Kremlin narrative. The leaked files, which detail activities up to 2025, include course syllabuses, staff contracts, and career assignments. Bauman has maintained military ties since its foundation in 1830, but Department 4 represents a deep integration into Russia's intelligence apparatus. The department is divided into three specialist streams, including the "Special Reconnaissance Service".
The GRU reportedly maintains direct control over recruitment and grading, with active officers overseeing examinations and placements. Lieutenant Colonel Kirill Stupakov, a signals intelligence specialist, leads the department. Lectures include instructions on electronic eavesdropping and the use of covert surveillance devices, such as cameras disguised as smoke detectors and keystroke loggers hidden in monitor cables.
The curriculum features a "Defense against technical reconnaissance" course, providing 144 hours of training in hacking techniques, including password attacks and the deployment of trojans. To pass, students must complete practical penetration tests and develop original computer viruses.
Instruction extends beyond technical exploitation to include information warfare. Advanced students are required to develop disinformation campaigns using psychological manipulation to impose "correct" perceptions on audiences. These teaching materials are heavily saturated with Kremlin orthodoxy, framing the conflict in Ukraine as inevitable and justified.
This academic focus aligns with observed Russian cyber activity. Dutch intelligence services recently reported an increase in Russian hybrid operations targeting European infrastructure, while Swedish officials have identified regular destructive cyber-attacks against EU institutions.
The documents trace the transition of students from the classroom to notorious cyber-units. Graduates from the spring 2024 cohort were reportedly assigned to groups such as "Fancy Bear" and Unit 74455, known globally as "Sandworm". The latter is responsible for significant international incidents, including attacks on the French presidential campaign and the South Korean Winter Olympics.
As the conflict in Ukraine persists, intelligence experts suggest Russia is intensifying its efforts to interfere with Western allies through deniable sabotage and cyber-attacks. The Bauman program shows no signs of slowing, with the current student cohort scheduled to graduate in 2027.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/russias-cyber-spy-training-faculty-9435.html
Comments