Leaked Documents Expose Secret Intelligence Faculty at the General Staff Directorate in Moscow

Journalists have revealed how Russia trains hacker-spies for the General Staff Directorate (GRU) at a prestigious Moscow university.

An international consortium of journalists (Le Monde, Der Spiegel, The Insider, and others) published an investigation based on a leak of over 2,000 internal documents from the Bauman Moscow State Technical University.

According to the materials, a classified “Department No. 4” operates within the university, training personnel for Russian military intelligence.

Training is conducted in three areas: “Special Intelligence Service,” “Information Technology Security,” and “Deployment and Defense Against Information and Technical Means of Influence.”

Graduates of the department become employees of Military Unit 26165 (known as the FancyBear or APT28 hacker groups).

In 2024 alone, at least 16 graduates of the Faculty of Computer Science joined the intelligence ranks.

Unit 26165 has been linked to cyberattacks on EU institutions, interference in the 2017 French elections, the hacking of TV5 Monde, and attacks on the 2024 Paris Olympics infrastructure. According to leaked documents, Bauman Moscow State Technical University sends 10–15 graduates annually to specialized intelligence units.

Key units and locations: The curriculum of “Department No. 4” includes studying the architecture of Pentagon networks, working with exploit tools (Metasploit), developing viruses and Trojans, and organizing DDoS attacks.

• Military Unit 74455 (Sandworm / VoodooBear): responsible for attacks on Ukraine’s power grid (2015), the US elections (2016), and cyberattacks on Poland (2025).
• Base locations: Anapa (near the ERA AI Center), Sevastopol (Military Unit 62174), and Kursk (Military Unit 48707, Research Center 11135).
• Structure: These units are part of the “information operations forces.”

Courses are offered in experimental psychology, the creation of manipulative content for social media, and information warfare strategies.

Professor Stupakov

The training program for military intelligence specialists at the university is headed by Lieutenant Colonel Kirill Stupakov. According to the investigation, he combines teaching with work in intelligence, where he headed military unit 45807 until July 2025.

The training course, developed by Stupakov and other officers, includes wiretapping, the use of microphones, and professional optics for remote surveillance.

It also covers the installation of mini-cameras in household appliances (such as smoke detectors).

Training is also underway to detect eavesdropping devices using the Russian ST-031 “Piranha” system.

“In closed Telegram chats, Stupakov criticizes the Russian Federation’s top leadership (Putin, Medvedev, Gerasimov) and expresses pessimistic predictions regarding the war against Ukraine,” journalists report.

Involvement of the High Command

According to leaked documents, high-ranking intelligence officers directly linked to international cybercrimes and sanctions lists are involved in the teaching staff and certification commissions of “Department No. 4.” Key figures: The training priorities include a detailed study of the structure and operating principles of the CIA, FBI, and NSA.

• Viktor Netishko: General of the Main Directorate of the General Staff (GRU), former head of Unit 26165 (Fancy Bear). Indicted in the US for interfering in the 2016 presidential election and hacking the Democratic Party’s data.
• Yuri Shikolenko: high-ranking officer of the Main Directorate of the General Staff (GRU), subject to UK sanctions (since July 2025) for organizing cyberattacks.
• Dmytro Velykorodnyi: senior lecturer, specialist in radiological, chemical, and biological defense (NBC).

Also, monitoring the equipment of the US and German armies are in focus. The Bundeswehr is a priority target for study on par with US forces.

They are studying the characteristics of Western drones, specifically the Switchblade 300, Black Hornet, and the German Vector.

Despite the intensity of the courses, internal reports by officers of the GRU note a “lack of understanding” among students regarding methods for conducting remote network attacks.

Career opportunities

Students of the specialized department undergo internships and are assigned to units of the GRU, as well as to strategic enterprises.

Internship and employment placements include the companies “Granit” (restoration of air defense systems, subject to sanctions by Ukraine and the EU) and “Malachite” (development of submarines, subject to sanctions by the EU and the US).

Also, the “Gamma” Research Center (information security) and the company “Dolomite” (hydrocarbon sector).

The occupied peninsula is a priority posting for graduates specializing in cryptography and electronic warfare. In particular, engineers have been assigned to military unit 62174 in Sevastopol.

The investigation revealed a practice of completely changing students’ identities before they complete their studies.

In March 2024, student Ivan Makarov (linked to the 26165 hacker unit) officially changed his name to Mark Fisher, receiving a corresponding set of new documents.