Military hackers in Russia: how the GRU uses universities to prepare for cyberwarfare

The training of military hackers in Russia constitutes one of the lesser-known components of the Kremlin's strategy for sustaining its cyber-espionage, sabotage and information-warfare operations. A leak of internal documents from Bauman Moscow State Technical University has made it possible to reconstruct the workings of Department No. 4, an academic structure linked to the Russian General Staff and the GRU, the military intelligence service responsible for some of the best-known cyber operations of recent years. The documents reveal training programmes combining cyberattacks, malware development, cryptography, counter-intelligence, propaganda and psychological operations, as well as placements in military units and strategic companies in the defence sector. They also show how lessons from the war in Ukraine are incorporated into teaching content and how certain graduates are ultimately assigned to units associated with groups such as APT28 and Sandworm. Beyond the preparation of specialists, the case exposes an institutional system designed to identify, train and retain technological talent, thereby ensuring the long-term continuity of Russia's cyber-warfare capabilities.

On 26 August 2026, DomainTools published a collection of internal documents attributed to Bauman Moscow State Technical University. The material described a system for selecting, teaching, evaluating, placing and assigning students according to the requirements of the Russian General Staff (DomainTools, 2026).

This was not, however, the first public disclosure to reveal information the so-called Department No. 4 at Bauman Moscow State Technical University. On 7 May 2026, a consortium comprising The Insider, Le Monde, Der Spiegel, The Guardian, Delfi, VSquare and FRONTSTORY.PL published an investigation based on more than 2,000 internal documents, including curricula, contracts, presentations, photographs and lists of students, graduates and teaching staff, relating mainly to the 2022–2024 period (Weiss et al., 2026).

DomainTools analysed this information, contextualising it with material disseminated through the DarkForums forum, and partially reconstructed the workings of the so-called Department No. 4 of the Military Training Centre as a channel for recruiting and preparing personnel for intelligence, cyber operations, planning and the protection of Russian military systems.

In June 2026, the DarkForums account "Losyash" distributed an archive of approximately 1.8 GB and a text claiming to have published 1,932 files, including Word documents, presentations, PDFs, spreadsheets, images and calendar or email files obtained using FOCA, containing metadata, usernames, folder hierarchies, personnel structures, speciality codes, approval chains and placement records consistent with the administrative and technical environment of Bauman University.

The body of documents showed strong indications of authenticity and institutional provenance, as it included personnel lists, calendars, examinations, attendance records, physical-fitness data, medical examinations, manpower planning, curricular materials, conference papers and correspondence.

At first sight, this was a corpus of documentation that, although directly affecting the Russian university, did not necessarily have to be significant at state level. However, analysis of the documents has revealed an institutional mechanism connecting the university, General Staff bodies, military units and entities within the Russian defence sector. Put differently, it shows how the Russian state selects, specialises and absorbs its human capital in order to sustain the long-term development of intelligence and information-environment operations capabilities. The training of military hackers in Russia thus appears as part of a much broader institutional system than the mere preparation of IT specialists.

this analysis

Facing such a volatile global security environment, conventional information is no longer sufficient. Rise above media noise by accessing independent and rigorous analysis .