Loading story…
Leaked internal records from Bauman Moscow State Technical University reportedly reveal that its Department No. 4 operated as a concealed military-training program feeding personnel into Russian General Staff, intelligence, cyber, and security organizations. The program, housed in the university’s Military Training Center, reportedly provided supervised technical and ideological preparation under three military specialties before placing selected graduates in roles involving offensive cyber operations, information warfare, technical reconnaissance, and defensive security.
The reported curriculum included vulnerability exploitation, password attacks, spearphishing, Trojan and malware development, DDoS attacks, penetration testing, electronic reconnaissance, propaganda, and psychological manipulation. The files describe oversight and placement links to GRU-associated Military Units 26165 and 74455, publicly linked to APT28 and Sandworm/APT44, respectively; reporting also linked a 2024 graduate, Aleksei Kondrashov, to Unit 74455, though the material does not establish that he or other named graduates took part in specific operations.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Reporting linked 2024 Department No. 4 graduate Aleksei Kondrashov to a placement at GRU Military Unit 74455, commonly known as Sandworm. The reporting does not establish his participation in a specific cyber operation.
The United States indicted Viktor Netyksho and 11 other GRU officers in connection with interference in the 2016 U.S. presidential election.
Sandworm, also associated with GRU Military Unit 74455, has been linked in reporting to the 2017 NotPetya attack.
Reporting states that Major General Viktor Netyksho and other GRU officers were connected to interference in the 2016 U.S. presidential election.
A leaked archive of internal Bauman Moscow State Technical University records reportedly exposed Department No. 4, a concealed program that trained and placed students into Russian General Staff, intelligence, cyber, reconnaissance, and information-warfare roles. The archive reportedly includes curricula, examinations, staffing, graduate, and placement records through 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcegbhackers.com
Open sourceschneier.com
Open sourcecyberveille.ch
Open sourcedti.domaintools.com
Open sourcecongress.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A journalistic investigation based on more than 2,000 leaked internal documents alleges that Bauman Moscow State Technical University runs a covert **"Department 4"** program inside its military training center to recruit and train cyber operators for Russia’s GRU. The reporting says GRU officers help control admissions, examinations, and graduate placements, while students are taught password attacks, software vulnerabilities, malware and trojan development, penetration testing, electronic surveillance, disinformation, and broader intelligence tradecraft. The documents reportedly tie graduates to GRU-linked units including **Unit 26165** (*Fancy Bear*) and **Unit 74455** (*Sandworm*), portraying a structured pipeline from university classrooms into offensive cyber and influence operations targeting Ukraine’s allies and Western states. One report said 69 students graduated from the program in 2024, with some allegedly assigned directly to prominent GRU hacking teams, and that the program remained active through 2025 with another cohort expected to finish in 2027.
Jun 29, 2026
Sandworm APT has conducted a targeted cyber espionage campaign against military entities in Belarus and Russia, including the Belarusian military and Russian Airborne Forces. The attackers leveraged malicious `.lnk` files and multi-stage PowerShell scripts to compromise systems, deploying backdoors that expose local services such as OpenSSH over the Tor network using obfs4 bridges. This infrastructure allows the threat actors to maintain persistent, anonymous access to compromised networks and evade traditional detection mechanisms. The infection chain often begins with decoy documents, such as nomination letters from military commanders, to lure victims into executing the malicious payloads. Once infected, the malware establishes persistence and configures the system to route sensitive services through Tor, enabling remote access via onion addresses. The campaign demonstrates a sophisticated approach to targeting high-value military personnel and infrastructure, with attribution pointing to the Sandworm APT group, known for its advanced capabilities and focus on Eastern European targets.
Jun 29, 2026
Western governments, investigators, and private-sector researchers have linked **Russia’s GRU**, including **Unit 26165** and other associated officers, to a broad campaign of cyber intrusions, destructive malware operations, and close-access hacking against political, diplomatic, and critical targets. Public reporting tied Unit 26165—also known as **Fancy Bear**—to the 2018 attempted compromise of the **OPCW** in The Hague, where Dutch authorities disrupted four Russian operatives allegedly equipped to target the organization’s Wi‑Fi network, and to earlier operations against anti-doping bodies and the device of **Yulia Skripal** using **`X-Agent`** malware. CrowdStrike previously attributed the intrusion into the **Democratic National Committee** to Russian actors associated with the same broader threat cluster. U.S., UK, and independent disclosures have expanded that picture by naming individual GRU officers and units allegedly involved in attacks on **Ukrainian critical infrastructure**, **France’s Macron campaign**, the **2018 Winter Olympics**, **NotPetya** victims, and reconnaissance that supported missile strikes on **Mariupol**, including the theatre attack. In 2020, the FBI publicized charges against six GRU officers for destructive malware and international cyberattacks, while Bellingcat used leaked Russian vehicle registration data to connect several indicted hackers to known GRU addresses tied to **Unit 74455** and related military intelligence infrastructure. The UK later imposed sanctions on multiple GRU units and 18 officers, describing the activity as part of a long-running Russian cyber and hybrid campaign against Ukraine, the UK, and other countries.
Aug 15, 2026