Russian military cyber training leak reveals GRU attackers' methods

Published August 24, 2026

A leaked archive from a Russian military university shows how the country trains people for hacking units linked to the GRU intelligence agency. It is not a new hack or malware, but a look at how Russia builds up its cyber attacker workforce.

Report priority
High
Targets
Bauman Moscow State Technical University+3 more

How it works

  • Researchers at DomainTools Investigations reviewed leaked personnel files, class schedules, and placement records from Department No.
  • 4 at Bauman Moscow State Technical University's Military Training Center, then matched graduates to known GRU hacking units.

What to do

Security teams at governments and critical infrastructure operators should watch for phishing, stolen-credential use, and exploitation of exposed systems, the documented tactics tied to graduates of this program.

Technical details

Affected software: Bauman Moscow State Technical University, GRU, Military Unit 26165, Military Unit 74455

The leaked material covers roughly 1,600 files describing about 250 students across three specialties: Special Intelligence Service, information-technical effects and protection, and information-technology protection. Coursework included password attacks, server exploitation, vulnerability research, malware creation, penetration testing, and attacker-versus-defender exercises. Graduates were reportedly placed with Military Unit 26165 (linked to APT28/Fancy Bear/Forest Blizzard) and Military Unit 74455 (linked to Sandworm).

One student paper described a phishing method using self-extracting archives and renamed UltraVNC binaries, similar to tactics seen in prior weaponized-document campaigns. Researchers found no evidence tying every named student to a specific intrusion.

References

View Original Source