Welcome to the GRU University, Where Moscow Turns Students into Spies and Hackers

Lucas Minisini (Le Monde)
Nikolai Antoniadis, Alexander Chernyshev, Roman Höfner, Roman Lehberger, Marcel Rosenbach, Fidelius Schmid, Thomas Schulz, Wolf Wiedmann-Schmidt, Anika Zeller (DER SPIEGEL)
Szabolcs Panyi (VSquare)
Research: Nikita Hava (VSquare)
Illustration: Hele-Mai Kulleste (Delfi Estonia) 2026-05-07

Investigations

At Bauman Moscow State Technical University in Moscow, Daniil Porshin was among the top students. The 25-year-old engineering student’s GPA often came close to a perfect score throughout his time at the prestigious institution between 2018 and 2024. But the young man from Irkutsk in Siberia, a member of the university football team, was not just a model student.

During his studies, Daniil Porshin took standard cybersecurity courses such as “cryptography” and “computer network security.” But he also learned how to “crack a password,” “create a virus,” and even “hack a server,” suggesting more troubling professional ambitions.

As soon as he graduated in 2024, the hacker trainee secretly joined Unit 26165 of the GRU, Russia’s military intelligence service. Known as “FancyBear” or “APT28,” this Russian hacking group was accused of hacking TV5 Monde to broadcast jihadist propaganda in 2015; Emmanuel Macron’s campaign team’s emails in early 2017; and, more recently, institutions linked to the organization of the 2024 Paris Olympic Games.

Daniil Porshin did not respond to questions from colleagues at M, the magazine of Le Monde. In 2024, when Porshin graduated, a total of 15 students with similar academic backgrounds also joined Russian military intelligence.

Since its founding in 1830, Bauman University has been one of Russia’s most prestigious technical universities. “Courage, will, work, perseverance” are its stated principles. Today more than 30,000 young people study at the university in eastern Moscow. Its computer science faculty is considered its flagship; many graduates end up at the country’s most important tech companies.

However, Bauman University also secretly trains spies. According to 2,000 internal documents obtained by an international consortium of media outlets including Le Monde, Der Spiegel, The Insider, The Guardian, Delfi Estonia, VSquare and FRONTSTORY.PL, the university hosts a clandestine section never mentioned in its official organizational chart: “Department No. 4.”

Source: Exclusive documents obtained by VSquare and its international partners

This unit prepares future Russian military intelligence officers—particularly hackers—through three tracks: “Deployment and Protection Against Information and Technical Means of Influence,” “Protection of Information Technologies,” and the largest specialization, titled “Special Intelligence Service.”

On April 15, 2026, Swedish Minister for Civil Defense Carl-Oskar Bohlin publicly accused Russia of regularly carrying out “destructive cyberattacks” against EU institutions.

In Germany, authorities have also attributed recent hacking attempts targeting the encrypted messaging app Signal—with the attempts aimed at European politicians and journalists—to agents of Vladimir Putin’s regime.

Poland experienced a record number of cyberattacks and incidents in 2025, according to a recent government report on the country’s cybersecurity. “The digital war being waged against Poland by other states is becoming increasingly visible in the data,” said Polish Deputy Prime Minister Krzysztof Gawkowski.

The hundreds of files obtained by the consortium—detailing the structure of this secret department, its curricula, classes, and lists of students and teachers—offer an unprecedented look into the “militarization of education in the midst of hybrid war,” said  geographer Kévin Limonier, a specialist in the Russophone cyberspace.

Courses in Hacking and Propaganda

Each year, between 10 and 15 Bauman students are assigned—before even finishing their studies—to the GRU units they are expected to join after graduation.

Some are sent to the more infamous units of Russia’s military machine, such as Unit 74455, better known as “Sandworm” or “VoodooBear.” This group has been accused by US and European authorities of orchestrating destabilization operations during the 2016 US presidential election, as well as large-scale cyberattacks on Ukraine’s power grid in 2015 and on Poland in December 2025.

According to a Bauman University document, some of its agents work out of Anapa, a town on the Black Sea, at a previously unknown secret military base located next to the ERA military research center specializing in artificial intelligence. One of the leaked files listing dozens of students and their future assignments also reveals little-known GRU units such as 62174, based in Sevastopol in illegally occupied Crimea, and 48707, which shares an address with the GRU’s Scientific Research Center 11135 in Kursk, near the Ukrainian border.

According to a February 2026 report by the investigative collective CheckFirst, which analyzed the insignia of these units—featuring a bat (symbolizing the GRU), a globe, and keys referencing cryptanalysis—these brigades belong to the “information operations troops,” also known as the VIO of Russian military intelligence. These forces were first mentioned in May 2014, shortly after Russia’s annexation of Crimea, by then–Defense Minister Sergei Shoigu, who described them as the spearhead of “cyber and information warfare,” relying on mathematicians, cryptographers, and telecommunications and electronic warfare specialists.

Department 4 at Bauman University teaches all these disciplines. During classes, students learn, among other things, the detailed functioning of protected computer networks of the US Department of Defense. According to leaked PDF files outlining course content, the students are also trained to “exploit vulnerabilities” in such systems using the Metasploit software, which has been identified in recent cyberattacks against Ukrainian government websites.

Those who enroll in the course “Countering Technical Intelligence,” spend a total of 144 hours over two semesters learning the complete toolkit of modern hackers. This includes all digital intrusion tools for penetrating foreign computer systems: from simple password attacks and the exploitation of known IT vulnerabilities to more sophisticated “trojans.” There are also “practical penetration tests” — hacking exercises. Especially important: Module 6, “Computer viruses.” At the end of the course, students must hack a test server.

The curriculum also covers tools and techniques for so-called distributed denial-of-service (DDoS) attacks. Such an attack — in which countless devices organized in botnets automatically bombard online services — recently caused problems for Deutsche Bahn customers when their app was unavailable for an extended period. Russian hackers also repeatedly take down the websites of institutions like airports and hospitals. It is a strategy of a thousand pinpricks.

More surprisingly, some classes introduce “experimental psychology” or the development of propaganda campaigns. One syllabus describes the “creation of a video for social networks, using manipulation, to support or refute a ‘hot’ topic,” promising to teach “information warfare” while citing the Prussian military theorist Carl von Clausewitz.

Even at this level of education, in a renowned institution, trainee hackers are themselves flooded with disinformation: Ukraine is described as a country “seeking nuclear weapons,” the West as having tried to destroy Russia in the 1990s and 2000s, and Russians in the Donbas region as threatened by a “genocide” backed by European countries. “This state-sponsored conspiracism structures and legitimizes Vladimir Putin’s regime,” Limonier explains. “Even among the country’s elites, these lies must be repeated.”

Professor Stupakov

This mix of technical skills and conspiracy theories was designed by Lieutenant Colonel Kirill Stupakov, the professor in charge of the entire program—himself also an intelligence officer within Russian military intelligence. According to his CV, which was found in the leaked documents, Stupakov headed GRU Unit 45807 for three years, until July 11, 2025. Within his teaching staff, he brought in several of the most senior hackers from Russian military intelligence.

Photo: Kirill Stupakov, Source: Exclusive documents obtained by VSquare and its international partners

A 34-slide PowerPoint presentation for one of his lectures depicts various methods of tapping phones and using directional microphones to eavesdrop on conversations in buildings across the street. Covert filming is also on the program: one slide shows a smoke detector with a mini-camera hidden inside. For surveillance over long distances, the lieutenant colonel recommends his students using a high-quality spotting scope from Nikon.

In another three-hour class, Stupakov teaches students how to detect bugs and other listening devices that an enemy might use to spy on them. A Russian device called the ST-031 P — also known as the “Piranha” — is used for this purpose.

Source: Exclusive documents obtained by VSquare and its international partners

Stupakov knows his subject matter well: he studied radio engineering at a military university in Cherepovets, roughly 500 kilometers north of Moscow. Leaked official records and documents suggest he was registered between 2004 and 2008 at an address associated with GRU Unit 61230.

In subsequent years, Stupakov — born in 1982 — worked at several military academies: he has been working at Bauman University’s Military Training Center at least since 2022. And here, too, a trail leads to the GRU: documents from the data leak reference a three-year contract that Stupakov allegedly signed in 2022 with GRU Unit 45807.

Internal evaluations paint the picture of a model officer: Stupakov is described as “goal-oriented,” “disciplined,” and “energetic,” with “excellent physical fitness,” “strong leadership qualities,” and “high professionalism.”

In public Telegram chats that consortium partner Der Spiegel was able to analyze, however, Stupakov expresses himself in strikingly disloyal terms. He mocks former President Dmitry Medvedev as an alcoholic, calls Vladimir Putin an “old man,” and dismisses Chief of the General Staff Valery Gerasimov as a “goddamn fool.” He takes a pessimistic view of the war against Ukraine: he complains about heavy losses and predicts the war will “end badly for us.”

To their students, Stupakov and his colleagues drum in entirely different messages. The “special operation” in Ukraine — Moscow’s euphemism for its war of aggression — was “inevitable,” the teaching materials state. “Nationalists and neo-Nazis” held sway there. A daily newsletter circulating at the university spreads rallying calls: “Strike down our enemies as our fathers, grandfathers, and great-grandfathers did.”

Learning from the Best

There are other prominent lecturers besides Stupakov. A letter preparing an exam session dated February 16, 2024 is signed “V. Netyshko,” referring to Viktor Netyshko, a GRU general who led Unit 26165 — better known as “Fancy Bear” — back when the group was accused of interfering in the 2016 US elections. Two years later, in July 2018, he was indicted along with 11 other Russian agents for hacking and leaking personal data of several figures in the US Democratic Party.

Another letter includes the signature “Yu. Shikolenko,” referring to Yuri Shikolenko, a senior GRU officer sanctioned by the United Kingdom since July 18, 2025 for his role in numerous cyberattacks conducted by Russian services. In several of these letters, these officers evaluate students who are about to join their ranks — often struggling to hide their disappointment: “Insufficient understanding of how to conduct remote network attacks,” reads one such file.

According to the leaked documents, the lecturers are also tasked with teaching the rising cadres about what enemy intelligence services and armies are capable of — and where their potential weaknesses may lie. Students thus learn, for instance, how US agencies like the CIA, FBI, and NSA operate. Another lecture covers the equipment of the US Army.

Germany’s is the only enemy military that students study as intensively as they do Russian and American forces. They are required to learn, among other things, how the Bundeswehr’s combat units are armed. Another lecture focuses on “the protection of information security in Germany.”

The aspiring officers are also being prepared for the future of warfare: a 54-slide PowerPoint deck lists various drone types. Mentioned are the US Kamikaze drone “Switchblade 300,” the Norwegian reconnaissance drone “Black Hornet,” and the vertical take-off “Vector” drone from the German manufacturer Quantum Systems, based in the Starnberg district. The war in Ukraine has demonstrated how unmanned aerial vehicles are fundamentally transforming the battlefield.

Based on research done by our  consortium, some teachers come from military families. In some cases, they are descendants of Soviet soldiers who occupied Central European countries. One such case is Dmitriy Velikorodnyy, born in Budapest, whose father served in the Soviet Southern Group of Forces. Today he is a Senior Instructor at Department 6 of the Bauman Military Training Center, specializing in CBRN defense: protection against chemical, biological, radiological, and nuclear weapons. In his various online accounts, he uses phrases reflecting his Hungarian origin — for example, using the Russian word vengrec (Hungarian person) in the name of at least two of his accounts.

Source: Exclusive documents obtained by VSquare and its international partners

Career Opportunities

To complete their training, Department 4 students undertake internships in various GRU units or, in some cases, within state-owned companies. Among these firms is Granit, a specialist in restoring air defense systems. Granit has been sanctioned by Ukraine since May 2023 and by the European Union since February 2024 for supporting the Russian fleet based in the Black Sea. 

Malakhit, a Saint Petersburg naval engineering bureau responsible for developing Russian submarine projects, has also been sanctioned by the EU and the United States for its role in the invasion of Ukraine. Other destinations, such as the Gamma research center for information system protection or Dolomit, a major hydrocarbon company registered in Dagestan, have so far avoided sanctions.

Many Bauman graduates begin their careers in the Russian military apparatus on the annexed Ukrainian peninsula of Crimea. Due to its proximity to other parts of Ukraine, Crimea is a stronghold of Russian air defense and signals intelligence.

The path of Ivan Zamotayev, now 25 years old, can be reconstructed: after training at and graduating from Department 4 as a specialist in information security and data encryption, in 2024 his road  led directly to Sevastopol in Crimea. There, according to the documents, he began service as “an engineer in the 3rd specialized department” of Unit 62174.

Officially the unit is supposed to ensure “military security.” Satellite imagery at the address of its headquarters reveals at least eight antenna installations. Whether Unit 62174 is also directly linked to the GRU or merely supports military intelligence cannot be determined.

According to the documents obtained by the consortium, in the latest cohort of trainee hackers — who will graduate at the end of the 2027 academic year — is one counterintelligence student who has changed his identity. In March 2024, Ivan Makarov, born in Moscow in 2001, whose father shares the same postal address as GRU Unit 26165, officially became “Mark Fisher.” A new passport, a new social security number. Open-source Russian databases reflect this name change, which also appears in the university’s administrative records.

Why such precautions for a student at Bauman University? As was the case when the GRU did something similar in 2022 with its agent Sergey Cherkasov — who became the Brazilian Victor Muller Ferreira — this generic new identity suggests that Ivan Makarov, now Mark Fisher, a hacker working for the GRU, could be sent to the West under a false identity as a clandestine agent.

Neither the university nor its teachers and students mentioned in this article responded to requests for comment.

Szabolcs Panyi

VSquare’s Budapest-based lead investigative editor in charge of Central European investigations, Szabolcs Panyi is also a Hungarian investigative journalist at Direkt36. He covers national security, foreign policy, and Russian and Chinese influence. He was a European Press Prize finalist in 2018 and 2021.