Loading story…
A journalistic investigation based on more than 2,000 leaked internal documents alleges that Bauman Moscow State Technical University runs a covert "Department 4" program inside its military training center to recruit and train cyber operators for Russia’s GRU. The reporting says GRU officers help control admissions, examinations, and graduate placements, while students are taught password attacks, software vulnerabilities, malware and trojan development, penetration testing, electronic surveillance, disinformation, and broader intelligence tradecraft.
The documents reportedly tie graduates to GRU-linked units including Unit 26165 (Fancy Bear) and Unit 74455 (Sandworm), portraying a structured pipeline from university classrooms into offensive cyber and influence operations targeting Ukraine’s allies and Western states. One report said 69 students graduated from the program in 2024, with some allegedly assigned directly to prominent GRU hacking teams, and that the program remained active through 2025 with another cohort expected to finish in 2027.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
On May 8, 2026, Germany's BKA and Frankfurt prosecutors announced that German and Spanish authorities had dismantled the relaunched Crimenetwork marketplace and arrested its suspected 35-year-old German operator in Mallorca under a European arrest warrant. Investigators said the revived platform had amassed more than 22,000 users, over 100 vendors, generated at least €3.6 million in revenue, and led to the seizure of about €194,000 and extensive user and transaction data.
Reporting published on May 7, 2026 said the alleged Department 4 program was still active, with another cohort not expected to graduate until the end of the 2027 academic year.
A journalistic investigation published in early 2026, based on more than 2,000 leaked internal documents, alleged that Bauman Moscow State Technical University runs a secretive Department 4 program under GRU influence to train and place cyber operators into Russian military intelligence units.
In March 2026, the operator of the original Crimenetwork marketplace was sentenced to seven years and 10 months in prison and ordered to forfeit more than €10 million in criminal proceeds, though the ruling was reported as not yet final.
According to leaked internal documents cited by journalists, 69 students graduated from Bauman Moscow State Technical University's secretive Department 4 program in 2024, with some allegedly assigned to GRU-linked units including Fancy Bear and Sandworm.
German authorities took down the original Crimenetwork marketplace in late 2024. Investigators later said the platform's operator rebuilt a successor site within days of this action.
The original Crimenetwork cybercrime marketplace began operating in Germany and later grew into what authorities described as the country's largest online cybercrime marketplace, with roughly 100,000 registered users.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcedarkwebinformer.com
Open sourcelemonde.fr
Open sourcetheguardian.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Leaked internal records from Bauman Moscow State Technical University reportedly reveal that its Department No. 4 operated as a concealed military-training program feeding personnel into Russian General Staff, intelligence, cyber, and security organizations. The program, housed in the university’s Military Training Center, reportedly provided supervised technical and ideological preparation under three military specialties before placing selected graduates in roles involving offensive cyber operations, information warfare, technical reconnaissance, and defensive security. The reported curriculum included vulnerability exploitation, password attacks, spearphishing, Trojan and malware development, DDoS attacks, penetration testing, electronic reconnaissance, propaganda, and psychological manipulation. The files describe oversight and placement links to GRU-associated Military Units `26165` and `74455`, publicly linked to APT28 and Sandworm/APT44, respectively; reporting also linked a 2024 graduate, Aleksei Kondrashov, to Unit 74455, though the material does not establish that he or other named graduates took part in specific operations.
Sep 3, 2026
Western governments, investigators, and private-sector researchers have linked **Russia’s GRU**, including **Unit 26165** and other associated officers, to a broad campaign of cyber intrusions, destructive malware operations, and close-access hacking against political, diplomatic, and critical targets. Public reporting tied Unit 26165—also known as **Fancy Bear**—to the 2018 attempted compromise of the **OPCW** in The Hague, where Dutch authorities disrupted four Russian operatives allegedly equipped to target the organization’s Wi‑Fi network, and to earlier operations against anti-doping bodies and the device of **Yulia Skripal** using **`X-Agent`** malware. CrowdStrike previously attributed the intrusion into the **Democratic National Committee** to Russian actors associated with the same broader threat cluster. U.S., UK, and independent disclosures have expanded that picture by naming individual GRU officers and units allegedly involved in attacks on **Ukrainian critical infrastructure**, **France’s Macron campaign**, the **2018 Winter Olympics**, **NotPetya** victims, and reconnaissance that supported missile strikes on **Mariupol**, including the theatre attack. In 2020, the FBI publicized charges against six GRU officers for destructive malware and international cyberattacks, while Bellingcat used leaked Russian vehicle registration data to connect several indicted hackers to known GRU addresses tied to **Unit 74455** and related military intelligence infrastructure. The UK later imposed sanctions on multiple GRU units and 18 officers, describing the activity as part of a long-running Russian cyber and hybrid campaign against Ukraine, the UK, and other countries.
Aug 15, 2026
A joint government advisory says Russia’s GRU Unit 26165, also tracked as **APT28** or **Fancy Bear**, has run a sustained cyberespionage campaign against Western logistics providers, technology companies, and defense supply-chain organizations supporting aid flows to Ukraine. The activity has affected entities in the United States, Germany, Poland, France, and Ukraine, with intrusions aimed at transportation networks, IT services, and military-related logistics. Officials said the operators also sought visibility into aid movements by compromising internet-connected IP cameras positioned near border crossings, rail hubs, and military facilities. Authorities linked the campaign to long-running GRU tradecraft previously used against governments, militaries, defense contractors, and cloud and email environments including Microsoft Office 365 and on-premises Exchange. Reported access methods include password spraying, brute-force and credential-guessing attacks, spearphishing, exploitation of known vulnerabilities including `CVE-2020-0688` and `CVE-2020-17144`, and the use of malware such as **HEADLACE** and **MASEPIE**, alongside web shells, Tor, VPNs, and living-off-the-land techniques to persist and exfiltrate data. Agencies warned the espionage effort remains active and urged organizations to enforce MFA, patch exposed systems, tighten access controls, monitor for lateral movement, and review supply-chain risk.
Jun 29, 2026