Hogwarts for Russian hackers: where GRU turns students into state-sponsored threat actors

Documents obtained by investigative journalists describe how the GRU, Russia’s military intelligence agency, is training students in hacking attacks and disinformation tactics at Bauman Moscow State Technical University. Yep, that’s where Sandworm and Fancy Bear get fresh talent from.

A secret “Department 4,” embedded within the university, acts as a Hogwarts for the GRU and consistently feeds fresh talent to Unit 29155, Fancy Bear, Sandworm, and other Russian state-sponsored hacking collectives.

That’s according to an investigation by The Insider and its partners, including Der Spiegel, The Guardian, and Le Monde. Journalists have obtained and analyzed 2,000 internal documents from Bauman University.

Some of the graduates are already serving in GRU Unit 74455, commonly known as Sandworm, which is responsible for attacks on civilian infrastructure in Ukraine, Georgia, and elsewhere.

During the courses, students are taught to create viruses and videos using “manipulation, pressure, and hidden propaganda,” and other skills relevant to the GRU. The training materials draw on the GRU’s experience gained during the full-scale invasion of Ukraine.

Another GRU Unit – 29155 – responsible for poisoning defectors, bombing ammunition and weapons depots, and working with the Taliban against the US and coalition forces in Afghanistan – also accepts talent from the aforementioned Department 4, The Insider said after analyzing what it called “a yearbook directory for incoming GRU operatives.”

Essentially, the outlet goes on, Moscow’s Bauman University is “a kind of Hogwarts for Russian spooks,” even though officially, it’s Russia’s rough equivalent of Massachusetts Institute of Technology.

Have thoughts about this topic? Others do, too. Join them in the discussion.

The university with more than 30,000 students concentrates on computer science. “Courage, will, work, persistence” is its motto.

But it also has a secret faculty called Department 4, where students are prepared to become officers, hackers, and saboteurs for the GRU.

Undergraduates at this spy school are taught information warfare, electronic reconnaissance, and IT-related special competencies, and at least some lecturers come from the GRU itself: much of the curriculum allegedly reads as if written by intelligence officers.

According to The Insider, the course called “Defense Against Technical Reconnaissance” is basically a complete toolkit of modern hackers.

“This includes all digital burglary tools for breaking into foreign servers, from simple spearphishing attempts to exploiting known IT vulnerabilities to more sophisticated Trojan horse viruses,” says the outlet’s report.

There are also “penetration testing with viruses,” i.e., hacking exercises. Module 6, for example, is dedicated entirely to computer viruses, and the final assignment is to program one’s own bespoke malware.

In 2024, a total of 1,563 reservists and 429 prospective contract officers studied at the department, specializing in 14 military areas. Anyone who survives basic training moves on to a course in espionage technology, according to The Insider.

Even though that’s not entirely surprising, the school is apparently particularly interesting in the US and teaches its cadres how the CIA, FBI, and NSA work. One lecture reportedly focuses entirely on the field equipment used by the US Army.