Kenneth Glad
Internal records from one of Russia’s leading technical universities suggest selected students were trained for roles tied to military intelligence. The documents point to a selective program that combined cyber instruction with assignments to units linked to Russian cyber operations.
A joint investigation by The Guardian, Der Spiegel, Le Monde, The Insider and VSquare found that internal records from Bauman Moscow State Technical University describe a little-known Department 4, also called “Special Training.”
The documents reviewed by the outlets include course materials, exam files, staff contracts and graduate placements covering several years through 2025.
The significance of the records is not only that Bauman has long-standing military ties. The investigation suggests recruitment for intelligence work may have been built into a formal academic track.
Lessons and selection
According to the consortium of media outlets, personnel from the GRU, Russia’s military intelligence agency, were involved in selecting, testing and assigning students.
A former senior Russian defense official described the process as a long chain of recruitment:
“Sometimes you are recruited first from school, then you go to Bauman University and enlist in the army… it is part of a continuous process.”
The Guardian writes that lieutenant colonel Kirill Stupakov led the department and taught subjects linked to electronic interception and covert surveillance.
The records also name Viktor Netyksho, a sanctioned major general who commanded Unit 26165.
Western authorities associate the unit with Fancy Bear, a Russian hacking group accused of cyber operations against governments and political targets.
The documents reviewed by the consortium show that students studied password attacks, software vulnerabilities, malware and penetration testing. In one assessment, they were reportedly required to create a computer virus.
Cyber unit placements
The training also covered information warfare. Advanced students were reportedly tasked with producing a social media video using “manipulation, pressure and hidden propaganda.”
Teaching materials cited by the outlets repeated Kremlin narratives about Ukraine, including claims that the war was “inevitable” and that Ukrainian leaders were “nationalists and neo-Nazis.”
Some students failed to qualify. One evaluation cited an “insufficient understanding of how to conduct an attack on a remote network.”
Others were directed toward units within or associated with the GRU. The outlets report that the records identify Daniil Porshin, a high-performing Bauman student and footballplayer (he’s currently playing professionally for the Russian First League club Rostov), as assigned to Unit 26165, associated with Fancy Bear. .
Another student placement was linked to Unit 74455 in Anapa, which Western governments and cybersecurity researchers have associated with Sandworm.
Bauman University, Stupakov, Netyksho and Porshin did not respond to requests for comment, according to the consortium.
The findings matter because they suggest Russia’s cyber-intelligence recruitment may be tied to formal academic structures, not only military academies or hiring after graduation.
The records suggest the program was still active, with the most recent cohort identified in the files due to graduate at the end of the 2027 academic year.
Sources: The Guardian, Der Spiegel, Le Monde, The Insider, VSquare
