Last April, Vladimir Putin visited the campus of Bauman Moscow State Technical University, located on the banks of the Yauza River in eastern Moscow. The university is home to some of the country’s brightest scientific minds. He toured the campus, met with undergraduates, and talked up Moscow’s ambitious plans for space missions to the moon and Mars. “You have everything it takes to be competitive,” Putin told the students.
What the Kremlin’s official account of Putin’s visit didn’t mention was a secret department within the university, simply called Department 4, or “Special Training.” There, a select group of students are quietly prepared for careers in the GRU—Russia’s military intelligence agency. GRU operatives have hacked Western parliaments, poisoned dissidents on foreign soil, and interfered in elections across Europe and the US.
Until now, the department’s role in training future intelligence operatives has remained largely secret, known only to a small group of insiders. “Sometimes you are first scouted from school, then go to Bauman and join the services… it’s part of a pipeline,” said a former senior Russian defense official.
This path—from one of Russia’s most prestigious institutions directly into its military intelligence apparatus—is revealed for the first time in over 2,000 internal documents from Bauman. These were obtained by a consortium of journalists from six outlets: the Guardian, Der Spiegel, Le Monde, the Insider, Delfi, and VSquare. The files, covering several years of activity up to 2025, include course syllabuses, exam records, staff contracts, and the career assignments of individual graduates. They trace the students’ journey from classroom exercises in hacking and disinformation to postings in some of the most notorious cyber-units within Russian military intelligence.
Bauman, one of Russia’s leading technical universities, has never hidden its ties to the military. Founded in 1830, it later trained the engineers and scientists who built Soviet rockets, tanks, and weapons systems, and it continues to do so today. In a 2013 internal letter seen by the Guardian, addressed to then-Defense Minister Sergei Shoigu, the university’s rector wrote that it carries out more research and development than any other higher education institution in Russia, with over 40% of it done in the interests of the Ministry of Defense.
The curriculum embedded within the university’s military training center, Department 4, is divided into three specialist streams, according to the documents. The most prominent, with the code 093400, is called the “Special Reconnaissance Service.” The documents suggest that the GRU has direct control over the recruitment and grading process—sending its own officers to conduct exams, approve candidates, and oversee placements. The picture that emerges is of a program where the line between professor and handler, and between teaching and recruitment, is blurred.
The department is led by Lieutenant Colonel Kirill Stupakov, a signals intelligence officer. According to the documents, he signed a three-year contract in 2022 with GRU Unit 45807, one of the agency’s key units. It’s not clear if he is still on active duty. At Bauman, Stupakov’s subjects include training students to master electronic eavesdropping and covert surveillance. PowerPoint slides, apparently designed for his lectures and reviewed by the consortium, amount to a catalog of deception: a smoke detector that is actually a camera, a device that sits undetected between a keyboard and a computer logging every keystroke, and a monitor cable that doubles as a silent screenshot machine, storing captures on a hidden flash drive.
Another teacher mentioned in the documents is Viktor Netyksho, a Western-sanctioned major general who commanded Unit 26165.A hacking group known as Fancy Bear – whose members were indicted by the US Department of Justice for interfering in the 2016 presidential election.
[View image in fullscreen: Home of the hacking group Fancy Bear, located in the building of the Russian military intelligence service in Moscow. Photograph: Alexander Zemlianichenko/AP]
Among the core courses is one called “Defence against technical reconnaissance.” Over 144 hours across two semesters, students learn the full toolkit of modern hacking, including password attacks, software vulnerabilities, and so-called trojans – malicious programs disguised as legitimate software that can give unauthorized access to a system.
To pass the course, students must carry out “practical penetration tests,” and one module is entirely focused on computer viruses. As part of the assessment, they have to develop one themselves.
Students are also taught the structure and organization of US and British military intelligence agencies. Separate sessions cover the use of Western intelligence in the war in Ukraine, and the development of enemy reconnaissance and strike drones on the Ukrainian battlefield.
In addition to hacking tasks, the curriculum includes information warfare. Advanced students must complete a seminar on developing a disinformation campaign, according to the documents. They are tasked with creating a social media video using “manipulation, pressure, and hidden propaganda.”
Students learn the mechanics of psychological manipulation and how to impose a “correct” perception of information on an audience.
The teaching materials also saturate students with Kremlin orthodoxy: the war in Ukraine was “inevitable”; “nationalists and neo-Nazis” are in power there; and Russians in the Donbas face “genocide,” backed by European countries.
Western intelligence services have become increasingly vocal about the scale of Russian cyber-activity in recent years.
In a report published in February, Dutch intelligence services warned that Russia was increasing hybrid activities across Europe, combining cyber-attacks, sabotage, and influence operations targeting critical infrastructure.
On April 15, Sweden’s minister for civil defense, Carl-Oskar Bohlin, publicly accused Russia of regularly carrying out destructive cyber-attacks against EU institutions.
From lecture hall to Sandworm
The documents suggest that among the 69 students who graduated from Department 4 in spring 2024 was Daniil Porshin, who had spent six years at Bauman maintaining near-perfect grades while playing for the faculty football team. Upon graduation, he was assigned to Fancy Bear.
Not every student makes the cut: the files show that dozens have been dismissed or failed to graduate, and the assessments of some students, written by the senior GRU officers who oversee the program, can be harsh. “Insufficient understanding of how to carry out a remote network attack,” reads one evaluation.
Many are deemed worthy of work inside the GRU, however: 15 others from Porshin’s cohort were similarly directed into GRU units.
Among them was a student who took up his first posting that summer, 900 miles (1,500 km) from Moscow at Unit 74455 in the Black Sea town of Anapa – one of Russia’s most popular holiday resorts, and home to the hacker unit known as Sandworm by Western governments.
[View image in fullscreen: FBI wanted poster from 2023 for six members of GRU Unit 74455, known as Sandworm. Photograph: FBI]
Sandworm has been accused by Western intelligence agencies of unleashing some of the most destructive cyber-attacks of the past decade, including targeting Ukraine’s power grid in 2015, Emmanuel Macron’s French presidential campaign in 2017, the South Korean Winter Olympics in 2018, and the British investigation into the Salisbury nerve agent poisoning.
The consortium sent requests for comment on the allegations to Bauman University, and to Netyksho, Stupakov, and Porshin, but had not received a response at the time of publishing.
As the wThe war in Ukraine continues, and intelligence experts suggest that Russia is stepping up its “hybrid” attacks on Ukraine’s European allies. They appear to be running a broad campaign of interference and sabotage aimed at causing chaos in the West, while keeping their actions deniable and avoiding crossing the line that could provoke a military response.
Hacking and cyber-attacks have been a key part of this strategy, and the documents indicate that the Bauman program shows no signs of slowing down. The latest group of trainees won’t graduate until the end of the 2027 academic year.
While this collection of documents offers an unprecedented look into Russia’s secretive and systematic training program for cyber-agents, insiders say it’s only part of the picture. According to a former defense official, another Russian university, Mirea, played an even more important role in training hackers.
“Bauman is one of a handful of elite universities used to identify talented students for recruitment into military and intelligence structures,” the source said.
Get in touch
Contact us about this story
The best public interest journalism relies on first-hand accounts from people in the know. If you have something to share on this subject, you can contact us confidentially using the following methods:
Secure Messaging in the Guardian app
The Guardian app has a tool for sending tips about stories. Messages are end-to-end encrypted and hidden within the routine activity that every Guardian mobile app performs. This prevents anyone from knowing you’re communicating with us at all, let alone what’s being said.
If you don’t already have the Guardian app, download it (iOS/Android) and go to the menu. Select ‘Secure Messaging’.
SecureDrop
If you can safely use the Tor network without being observed or monitored, you can send messages and documents to the Guardian via our SecureDrop platform.
Our guide at theguardian.com/tips lists several ways to contact us securely and discusses the pros and cons of each.
Frequently Asked Questions
Here is a list of FAQs about the reported Russian spy school based on publicly available information and investigative reports
BeginnerLevel Questions
1 What is this spy school exactly
Its a secret training facility run by Russias intelligence services Its designed to teach new recruits how to conduct cyber operations including hacking spreading disinformation and interfering in foreign elections
2 Where is it located
Investigative reports such as those from The Insider and Der Spiegel pinpoint the school near the town of Sernur in the Mari El Republic of Russia about 500 miles east of Moscow Its often referred to as the Sernur facility
3 Who attends this school
Recruits are typically young techsavvy Russians often recruited from universities or military academies They are vetted for loyalty and aptitude before being trained as cyber spies
4 What do they actually teach there
The curriculum reportedly includes
Hacking techniques Breaking into computer networks stealing data
Social engineering Tricking people into revealing passwords or information
Disinformation Creating fake news fake social media accounts and bots to manipulate public opinion
Election interference Methods to hack voting systems steal campaign emails and use leaks to influence voters
5 Is this school real or just a rumor
Its real Multiple investigative journalists and intelligence sources have confirmed its existence Photos and satellite images of the facility have been published and former employees have been interviewed
6 Has the school been linked to specific attacks
Yes Investigators believe graduates of this school were involved in major operations including
The 2016 US election interference
The Hack and Leak operations against the 2017 French election
The hacking of the World AntiDoping Agency in 2016
Advanced Questions
7 How does the school differ from a regular hacking group
A regular hacking group is usually motivated by money This school is statesponsored and politically motivated Its goal is not financial gain but geopolitical advantageweakening enemies sowing chaos and influencing foreign governments The training is also far more systematic and
