Every year, 10 to 15 students receive assignments to a specific GRU unit even before graduation. They are taught to write Trojans, conduct DDoS attacks and create “social videos with manipulation, pressure and hidden propaganda” — in lectures that also cite Clausewitz. The Insider ↗
Graduates and teachers connected to Bauman’s department appear in U.S. indictments over 2016 election interference, on FBI Most Wanted lists and in British sanctions from 2025. Attacks attributed to these units hit Macron’s election campaign in 2017, institutions connected to the Paris 2024 Olympics and infrastructure in more than a dozen Western countries. The Insider ↗
Secret Department No. 4 — anatomy of the training
Bauman University has been one of Russia’s most prestigious technical schools since 1830, often compared to Moscow’s MIT. More than 30,000 students, the motto “Courage, will, work, perseverance”. In mechanical design and space technology it ranks among the global elite. But its Military Training Center also houses Department No. 4, which is missing from the official organizational chart and whose deliberately uninformative name is “Special Training”. The Insider ↗According to the leaked documents, the department has three specializations. The largest of them carries the code 093400 and the name “Special Intelligence Service”. There, students learn information warfare, electronic reconnaissance and what Le Monde called “a complete arsenal of tools for digital intrusions”. The course “Defense Against Technical Reconnaissance” lasts 144 hours over two semesters. Module 6 is devoted exclusively to computer viruses and the final exercise reads: program your own malware. Le Monde ↗
In 2024, 1,563 reservists and 429 future contract officers studied at the department in fourteen military specializations. The training also includes a mandatory seminar, “Development of a Propaganda Campaign”, in which students are asked to “create a social video for or against a hot topic with manipulation, pressure and hidden propaganda”. Teaching materials present Ukraine as a country “seeking a nuclear weapon” and the West as an entity that “wanted to destroy Russia in the 1990s”. VSquare ↗
Names and faces
The department is headed by Lieutenant Colonel Kirill Stupakov, born in 1982. According to his CV from the leak, he led GRU unit 45807 for three years and left the post on July 11, 2025. In internal evaluations he is described as “goal-oriented”, “disciplined” and “energetic”. In private Telegram chats, however, which The Insider obtained together with Der Spiegel, he speaks differently about his country’s leadership: he calls Putin an “old man”, refers to Chief of the General Staff Valery Gerasimov in vulgar terms and predicts of the war that it “will end badly for us”. The Insider ↗Stupakov’s lecturing staff also includes Major General Viktor Netyksho. He led GRU unit 26165, known by the nickname Fancy Bear, at the time when the unit was stealing emails from the Democratic National Committee before the 2016 U.S. presidential election. In July 2018, Netyksho — together with eleven other GRU officers — was indicted by special counsel Robert Mueller. He is sanctioned in the European Union, the United Kingdom and the United States. At Bauman, he appears as a signatory of examination correspondence from February 2024. The Insider ↗
The second prominent signature on the documents belongs to Yuri Shikolenko, a senior GRU officer whom the British government added to its sanctions list on July 18, 2025 precisely for involvement in cyberattacks.
Among students, a typically quiet career follows. Daniil Porshin, a 25-year-old student from Irkutsk with a grade average close to the maximum score, played for the university football team and after graduating in 2024 secretly joined Fancy Bear. Vladislav Borovkov belongs to GRU unit 29155, which Western governments and investigators link to poisonings of defectors and arms dealers, explosions at ammunition depots and cyber operations against critical infrastructure in more than ten countries. His photograph is on the FBI Most Wanted list. Alexei Kondrashov, a recent 2024 graduate, before joining Sandworm posted photographs on the Russian network VKontakte with a Justin Bieber-style haircut and in a little hat. The Insider ↗
The last named has a particular resonance for a Central European reader. Dmitry Velikorodny works as a senior instructor in the 6th department of the Military Training Center, specializing in chemical, biological, radiological and nuclear defense. In several online registrations he uses the Russian-transcribed word “Hungarian” (vengrec, Мадьяр). His father served in the Soviet Southern Group of Forces, which occupied Hungary until 1991. Direkt36 / Pányi Szabolcs ↗
From school benches to global attacks
GRU unit 26165 (Fancy Bear, also known in the IT security world as APT28) is accused of the hacking attack on the French station TV5 Monde in 2015, whose broadcast was briefly infiltrated by jihadist propaganda; of eavesdropping on Emmanuel Macron’s election campaign in 2017; and, according to the investigative consortium, also of attacks on institutions connected to the Paris 2024 Olympics. VSquare ↗Its sister unit 74455 (Sandworm, or VoodooBear) is responsible for the most destructive cyberattack in history — NotPetya in 2017. The malicious software hit more than 160 countries, paralyzed the Danish shipping company Maersk, the U.S. pharmaceutical group Merck and hospitals in the U.S. state of Pennsylvania. Losses at the largest affected companies were counted in the hundreds of millions of dollars; open global estimates of NotPetya go significantly higher. Sandworm later put its signature to attacks on Ukraine’s energy sector, state treasury, Georgian websites, the Organisation for the Prohibition of Chemical Weapons and the Winter Olympics in Pyeongchang in 2018. The Insider ↗
Documents from Stupakov’s department also revealed previously unknown locations. Near the spa town of Anapa by the Black Sea there is a military base adjacent to the ERA scientific center, which specializes in the military use of artificial intelligence. The list of future assignments includes units 62174 in Sevastopol in occupied Crimea and 48707 in Russia’s Kursk, which shares an address with the GRU research center 11135 near the Ukrainian border. VSquare ↗
NATO’s eastern flank under pressure
Department No. 4 does not operate in a vacuum. Poland in 2025 recorded a record number of cyber incidents, which Deputy Prime Minister Krzysztof Gawkowski called a “digital war being waged against Poland by other states”. Sweden’s Minister for Civil Defence Carl-Oskar Bohlin said on April 15, 2026, that pro-Russian groups are moving from DDoS attacks to “destructive cyberattacks” against organizations in Europe, including Sweden’s energy sector. VSquare ↗In Germany, intelligence services attributed to Putin’s agents a phishing campaign against politicians and journalists on the Signal app, which also affected the president of the Bundestag and two ministers.
Read also: Bundestag president and two ministers among the victims. Berlin investigates espionage
Bauman graduates do not always end up in army units. Some leave for internships at companies that are already under sanctions. The Granit plant, which repairs air defense systems for the Black Sea Fleet, has been on the European Union sanctions list since February 2024. The St. Petersburg engineering firm Malachit, involved in Russia’s submarine program, is under EU and U.S. sanctions. The Gamma scientific center and the Dagestan oil concern Dolomit, which also accept interns from Department No. 4, remain outside sanctions lists for now. The Insider ↗
An analyst at the European Centre of Excellence for Countering Hybrid Threats told The Insider that “the universities, companies and teachers involved in this process become accomplices in the development of Russian hybrid capabilities — and therefore candidates for their own countermeasures, including sanctions”.
Velebit, DHL packages and open questions
The Bauman documents show that the career paths of Department No. 4 graduates lead not only to cyber units, but also to formations linked to GRU sabotage operations. Vladislav Borovkov is exactly from there — from unit 29155, which VSquare in a parallel investigation linked to the sending of explosive packages through the DHL delivery network in the summer of 2024. VSquare ↗At the time the consortium was preparing publication, authorities in the Balkans were dealing with a similar episode. On April 5, 2026, Serbian police found two backpacks near the northern Serbian village of Velebit containing four kilograms of plastic explosive, detonators and detonation cord — several hundred meters from the TurkStream gas pipeline, which carries Russian natural gas to Hungary. Prime Minister Viktor Orbán deployed the army to the Hungarian section of the pipeline and, six days before parliamentary elections, suggested that “Kyiv has been trying for years to cut Europe off from Russian energy”. RFE/RL ↗
The version about Ukrainian responsibility, however, quickly began to crumble. The head of Serbia’s military intelligence service, Djuro Jovanić, publicly stated that same week that “it is not true that Ukrainians wanted to organize the sabotage”; according to him, the markings on the explosive point “undoubtedly” to an American manufacturer. The main lead in the Serbian investigation became a migrant with military training. Ukraine’s Ministry of Foreign Affairs called the find a “likely Russian false-flag operation — part of Moscow’s strong interference in the Hungarian elections”. Kyiv Independent ↗
There is still no public attribution in the Velebit case and the Serbian investigation continues. The case, however, fits into the broader European context of sabotage and cyber incidents in which Western governments have in the past named mainly GRU units 29155, 26165 and 74455 — the explosions of ammunition depots in Vrbětice in 2014 (Czech authorities attributed them to the GRU), poisonings of arms dealers and defectors, packages with improvised explosives in the air cargo network, as well as a plan for two politically motivated murders that Lithuania in April exposed against thirteen people from eight countries.
Read also: Lithuania charged 13 people from eight countries over a GRU plan for two murders
In April 2025, Vladimir Putin personally came to Bauman. He promised support for quantum technology and space research. The words Department No. 4 were not heard in his speech. The Insider ↗
What hotinfo is watching
- The EU's next sanctions package includes Bauman University or Stupakov
- The Hungarian government responds to the Velikorodny/Magyar link (a parliamentary question, a media response, a Direkt36 or VSquare follow-up)
- Serbian prosecutors publish an attribution for the Velebit find (the TurkStream sabotage of April 5, 2026)
- Poland, the Baltics or Slovakia attributes a specific operation to Sandworm or Fancy Bear
