Elite Moscow University as a Secret School for Russian Spies

In April, Russian President Vladimir Putin visited the campus of the Bauman Moscow State Technical University, located on the banks of the Yauza River in the east of the city, where some of the country's brightest scientific minds are educated.

He toured the campus, spoke to students and praised Moscow's ambitious plans for space missions to the Moon and Mars. "You have everything you need to be competitive," Putin told the students.

What the Kremlin's official report on this visit did not mention was a secret department within the university, known as Department 4 or "Special Training."

There, a select group of students quietly prepare for careers in the GRU - the Russian military intelligence service, whose operatives have hacked Western parliaments, poisoned dissidents abroad and interfered in elections across Europe and the United States.

Until now, his role in preparing future intelligence operatives has been largely secret, known only among a select group of insiders.

"Sometimes you are first noticed while still in school, then you go to Bauman and join the services ... it's part of a recruitment system," said a former senior Russian defense official.

The existence of this path, from one of Russia's most prestigious institutions directly into the military intelligence apparatus, was first revealed through more than 2.000 internal documents from Bauman University, obtained by a consortium of journalists from six newsrooms: The Guardian, Spiegel, Le Monde, Insider, Delfi and Vsquare.

The documents, which cover several years of activity up to 2025, include curricula, exam transcripts, employment contracts and career schedules of individual graduates, tracing their journey from classroom hacking and disinformation exercises to deployments to some of the most notorious cyber units of the Russian military intelligence apparatus.

Bauman, one of Russia's leading technical universities, has never hidden its ties to the military. Founded in 1830, it later trained engineers and scientists who developed Soviet missiles, tanks, and weapons systems, and continues to do so today.

In an internal letter from 2013, seen by The Guardian and addressed to then-Defense Minister Sergei Shoigu, the rector stated that the university conducts more research and development than any other higher education institution in Russia, with more than 40 percent of that activity being conducted in the interests of the Ministry of Defense.

Curriculum

Within the university's military training center, Department 4 is, according to documents, divided into three specialized directions. The most prominent, code 093400, is called the "Special Reconnaissance Service."

The documents show that the GRU has direct control over the recruitment and evaluation process - sending its own officers to conduct exams, approve candidates and oversee deployments. The documents paint a picture of a program in which the line between professor and operational manager, as well as between teaching and recruitment, is blurred.

The department is headed by Lieutenant Colonel Kirill Stupakov, a signals intelligence officer who, according to documents, signed a three-year contract with GRU Unit 45807, one of the agency's key units, in 2022. It is unclear whether he is still in active service.

At Bauman, Stupakov teaches courses that train students in electronic eavesdropping and covert surveillance. The PowerPoint slides, apparently designed as supporting material for his lectures and seen by the consortium, present a catalogue of deceptions: a smoke detector that is actually a camera, a device that is placed between the keyboard and the computer and records every keystroke, a monitor cable that also records the screen and stores the recordings on a hidden USB drive.

Another lecturer mentioned in the documents is Viktor Netishko, a major general who was under Western sanctions and commanded Unit 26165 - a hacking group known as "Fancy Bear" - whose members were accused by the US Department of Justice of interfering in the 2016 presidential election.

Among the key courses is “Defense Against Technical Reconnaissance.” Over 144 hours over two semesters, students learn the full set of modern hacking tools, including password attacks, software vulnerabilities, and so-called Trojans—malicious programs disguised as legitimate software that can provide unauthorized access to a system.

To pass the course, students must conduct “practical penetration tests,” while one module is entirely devoted to computer viruses. As part of the assessment, they are required to develop one of their own.

Students are also taught the structure and organization of American and British military intelligence services. Separate sessions are devoted to the use of Western intelligence in the war in Ukraine, as well as the development of enemy reconnaissance and strike drones on the Ukrainian battlefield.

In addition to hacking assignments, the curriculum also includes information warfare. Advanced students must complete a seminar on developing a disinformation campaign, which requires them to create a video for social media using “manipulation, pressure, and covert propaganda.”

Students are also taught the mechanisms of psychological manipulation and how to impose the "correct" perception of information on the audience.

Teaching materials, meanwhile, bombard students with Kremlin ideology: the war in Ukraine was “inevitable,” “nationalists and neo-Nazis” are in power in that country, and Russians in Donbas are being subjected to “genocide,” with the support of European countries.

In recent years, Western intelligence services have been increasingly warning about the scale of Russian cyber operations.

In a report published in February, Dutch intelligence services warned that Russia was stepping up hybrid activities across Europe, combining cyberattacks, sabotage and influence operations targeting critical infrastructure.

On April 15, Swedish Minister of Civil Protection Karl-Oskar Bolin publicly accused Russia of regularly carrying out destructive cyberattacks on European Union institutions.

From the classroom to Sandworm

Documents show that among the 69 students graduating from Division 4 in the spring of 2024 was Danil Porshin, who had nearly perfect grades for six years at Bauman University, while also playing for the faculty's football team. Upon graduation, he was assigned to the Fancy Bear unit.

Not every student makes it through the selection process: documents show dozens of students were expelled or did not graduate, and some were given harsh evaluations by senior GRU officers overseeing the program. “Insufficient understanding of how to conduct a remote network attack,” one assessment states.

Still, many are considered sufficiently qualified to work within the GRU: another 15 students from Porshin's generation have been assigned to similar units.

Among them was a student who got his first job that summer, about 1.500 kilometers from Moscow, at unit 74455 in the Black Sea city of Anapa - one of Russia's popular resorts and home to a hacking unit known in the West as Sendvorm.

Western intelligence agencies have accused Sendworm of carrying out some of the most devastating cyberattacks of the last decade, including an attack on the Ukrainian power grid in 2015, hacking during Emmanuel Macron's presidential campaign in 2017, attacks on the 2018 Winter Olympics in South Korea, and operations related to the British investigation into the Salisbury nerve agent poisoning.

The Consortium of Journalists sent requests for comment on the allegations to Bauman University, Netiška, Stupakov, and Poršin, but no response was received by the time the article was published.

As the war in Ukraine continues, intelligence experts suggest that Russia is stepping up “hybrid” attacks on Ukraine’s European allies, attempting to conduct a broad campaign of interference and sabotage to cause chaos in the West while maintaining the ability to deny responsibility and not crossing the threshold that could trigger a military response.

Hacking operations and cyberattacks are a key part of that strategy, and the documents suggest that the program at Bauman University shows no signs of slowing down. The latest generation of students will not graduate until the end of the 2027 academic year.

While this collection of documents provides an unprecedented glimpse into a secret and systematic training program for Russian cyber agents, insiders say it is only part of the bigger picture. Another Russian university, Mirea, plays an even more important role in training hackers, according to a former military official.

“Bauman is one of several elite universities used to identify gifted students for recruitment into military and intelligence structures,” the source said.