A major international investigation published in May 2026 has exposed a secret department within Russia's premier technical university that serves as a direct talent pipeline into the country's most dangerous state-sponsored hacking groups. Department 4, embedded within the military training center of Bauman Moscow State Technical University — one of Russia's most prestigious engineering schools — trains 10 to 15 students per year under the supervision of GRU (Glavnoye Razvedyvatelnoye Upravleniye — Russia's military intelligence directorate) officers, assigning graduates directly to units including Fancy Bear, Sandworm, and Unit 29155 before they even finish their degrees.
The investigation was conducted by Meduza, VSquare.org, and several partner outlets, and represents one of the most detailed open-source intelligence reconstructions of Russia's cyber-operator recruitment pipeline to date.
Department 4: Technical Details
Department 4 operates within the formal military training center (kafedra) structure of Bauman University, using the legitimate educational institution as organizational cover for a program that is functionally a GRU intelligence academy.
The curriculum is documented through leaked course materials and testimony from individuals with direct knowledge of the program. Students enrolled in Department 4 complete a two-semester, 144-hour course titled "Defence against technical reconnaissance" — a title that deliberately frames offensive techniques as defensive knowledge, a common feature of military intelligence training programs. The course covers:
- Password attacks: credential harvesting, brute-force and dictionary techniques, pass-the-hash attacks
- Software vulnerabilities: the identification, analysis, and exploitation of bugs in operating systems and applications
- Computer trojans and viruses: malware design, delivery mechanisms, and persistence techniques
- Psychological manipulation: social engineering, pretexting, and influence operations
- Information warfare: disinformation techniques, narrative shaping, and influence campaign design
- Surveillance devices: wiretapping technology, hardware implants, and physical surveillance tradecraft
The program explicitly trains students in the intersection of technical cyber operations and broader intelligence tradecraft — producing operators capable of functioning within the combined-arms hacking-and-influence-operations model that characterizes Russia's most sophisticated APT groups.
A key figure within the program is Lieutenant Colonel Kirill Stupakov, the department's deputy head, who teaches a special course on espionage technology that covers wiretapping methods and surveillance techniques. Viktor Netyksho — a major general who previously commanded Unit 26165 (widely known as Fancy Bear or APT28 in the cybersecurity industry) — has been connected to the program, indicating direct continuity between the training institution and the operational units receiving its graduates.
The GRU Units Receiving Department 4 Graduates
Students completing the Department 4 program are assigned to their designated GRU units before graduation — some while still finishing coursework. The confirmed receiving units include:
Unit 26165 — Fancy Bear / APT28: Russia's premier cyber-espionage group, responsible for the 2016 U.S. Democratic National Committee intrusion, the 2017 French election interference campaign, and sustained targeting of NATO member defense ministries, think tanks, and government agencies. Fancy Bear specializes in spear-phishing, credential theft, and long-duration access operations.
Unit 74455 — Sandworm / VoodooBear: Widely assessed as the world's most destructive state-sponsored threat actor. Sandworm deployed the NotPetya wiper in 2017 (causing an estimated $10 billion in global economic damage), disrupted Ukrainian power grids in 2015 and 2016, and is currently assessed to be conducting cyber operations in support of Russia's ongoing military campaign in Ukraine. Sandworm specializes in destructive attacks targeting operational technology (OT) environments and critical infrastructure.
Unit 29155: A GRU unit associated with assassination operations, sabotage, and destabilization campaigns across Europe, including the 2018 Salisbury nerve-agent poisoning. Unit 29155 has increasingly incorporated cyber capabilities into its operational portfolio.
Exploitation Status and Threat Landscape
The Department 4 investigation does not disclose an immediately patchable vulnerability, but its threat intelligence value for defensive security teams is significant. It confirms that Russia's GRU maintains a structured, institutionalized capability-development pipeline — not a collection of freelance contractors or opportunistic recruits, but a sustained educational program that continuously generates trained operators who enter the GRU's most dangerous units as credentialed cyber professionals.
This distinction matters for threat modeling. Fancy Bear and Sandworm operators are not self-taught hackers who stumbled into state service. They are graduates of a two-semester program specifically designed to develop their skills under the supervision of active intelligence officers, followed by careers of increasingly sophisticated operations within well-resourced, professionally organized units.
The investigation also documents the use of Bauman University as institutional cover — a tactic that makes it difficult to place export restrictions or sanctions on the individuals involved until they appear in indictments, as the university itself has legitimate academic standing internationally.
The U.S. Department of Justice has previously unsealed indictments naming Fancy Bear and Sandworm officers who graduated from Russian military technical universities, but those individuals were typically identified years after their operational activity began. Department 4's existence suggests the talent pipeline producing those operators is structured, predictable, and ongoing.
Who Is Affected
The threat intelligence exposed by this investigation is operationally relevant to any organization that is a Fancy Bear, Sandworm, or Unit 29155 target, which historically includes:
- NATO member governments and defense ministries
- Political parties and election infrastructure in democratic countries
- Defense contractors and industrial manufacturers involved in military supply chains
- Critical infrastructure operators — power grids, water utilities, financial institutions — particularly in Ukraine and NATO member states
- Think tanks, NGOs, and media organizations covering Russia's military operations
- Technology and cloud providers whose services are used by the above targets
For SOC teams and threat intelligence analysts, this investigation provides useful context for understanding why Fancy Bear and Sandworm intrusions tend to display a consistent level of operational sophistication: the operators are trained professionals, not hobbyists.
What You Should Do Right Now
- Reassess your threat model. If your organization falls into any of the target categories above, explicitly include GRU-affiliated APTs (APT28/Fancy Bear, Sandworm, Unit 29155) in your threat actor matrix and ensure your detection rules include their TTPs (Tactics, Techniques, and Procedures as defined by MITRE ATT&CK).
- Review Fancy Bear and Sandworm IOCs. MITRE ATT&CK provides detailed TTP profiles for APT28 (G0007) and Sandworm (G0034). Ensure your SIEM (Security Information and Event Management — the centralized log analysis and alerting platform used by security operations centers) contains detection rules for their known techniques.
- Harden spear-phishing defenses. Fancy Bear's primary initial access vector is targeted spear-phishing. Enforce FIDO2/hardware security keys for privileged accounts, deploy email authentication (DMARC, DKIM, SPF), and conduct regular phishing simulation exercises.
- Protect OT environments from IT network lateral movement. Sandworm's destructive operations typically begin with IT network compromise and pivot to OT systems. Enforce strict IT/OT network segmentation with unidirectional data diodes or air gaps for the most sensitive industrial control systems.
- Track CISA joint advisories. CISA regularly publishes joint advisories on Russian GRU activity in partnership with NCSC-UK and international partners. Subscribe to CISA's alert feed to receive these advisories when published.
Background: Understanding the Risk
The Department 4 revelations illuminate a structural feature of Russian state-sponsored hacking that distinguishes it from most other threat actor categories: it is not opportunistic but systematic. Russia's GRU has invested in a multi-decade capability-building enterprise that treats cyber warfare as a military discipline, with formal training, ranks, career progression, and institutional knowledge transfer between generations of operators.
This institutional depth produces several characteristics that security teams encounter in practice. GRU operators demonstrate consistent tradecraft: their initial access techniques, persistence mechanisms, and lateral movement patterns reflect shared training, not independent improvisation. Their operations are patient — reconnaissance can span months before active exploitation begins. And their targeting is strategic: they prioritize intelligence value and geopolitical impact over financial return.
For the broader cybersecurity community, Department 4 also raises questions about the degree to which Western universities are analogously being targeted for talent recruitment by GRU fronts or affiliated organizations — a topic that intelligence services in the U.S., UK, and Germany have raised in recent years.
Conclusion
Department 4 at Bauman Moscow State Technical University is an active, institutionalized GRU talent pipeline that produces trained cyber operators who graduate directly into Fancy Bear, Sandworm, and Unit 29155. The investigation confirms that Russia's most destructive and dangerous hacking groups are not improvised — they are staffed by career professionals trained in a formal program. Organizations targeted by GRU-affiliated APTs should review their ATT&CK-aligned detection coverage, harden spear-phishing defenses, and treat GRU operator sophistication as a structural baseline rather than an exception.
For any query contact us at contact@cipherssecurity.com
