Last April, Vladimir Putin visited the campus of Bauman Moscow state technical university, set on the banks of the Yauza River in the east of the city and home to some of the country’s brightest scientific minds.

He toured the campus, met undergraduates and boasted about Moscow’s ambitious plans for space missions to the moon and Mars. “You have everything it takes to be competitive,” Putin told the students.

What the Kremlin readout of Putin’s visit did not mention was a secret faculty inside the university, known simply as Department 4, or “Special Training”.

Here, a select group of students are quietly prepared for careers in the GRU – Russia’s military intelligence directorate, whose operatives have hacked western parliaments, poisoned dissidents on foreign soil and interfered in elections across Europe and the US.

Until now its role in preparing future intelligence operatives has remained largely secret, save among a select group of insiders.

“Sometimes you are first scouted from school, then go to Bauman and join the services … it is part of a pipeline,” said a former senior Russian defence official.

The existence of this path, from one of Russia’s most prestigious institutions directly into its military intelligence apparatus, is revealed for the first time in more than 2,000 internal documents from Bauman, obtained by a consortium of journalists from six outlets: the Guardian, Der Spiegel, Le Monde, the Insider, Delfi and VSquare.

The files, covering several years of activity up to 2025, include course syllabuses, exam records, staff contracts and the career assignments of individual graduates, tracing their path from classroom exercises in hacking and disinformation to postings in some of the most notorious cyber-units in the Russian military intelligence apparatus.

Bauman, one of Russia’s leading technical universities, has never hidden its ties to the military. Founded in 1830, it later trained the engineers and scientists who built Soviet rockets, tanks and weapons systems and continues to do so today.

In a 2013 internal letter seen by the Guardian and addressed to the then defence minister Sergei Shoigu, the university’s rector wrote it carries out more research and development than any other higher education institution in Russia, with more than 40% conducted in the interests of the ministry of defence.

The curriculum

Embedded within the university’s military training centre, Department 4 is divided into three specialist streams, the documents suggest. The most prominent, bearing the code 093400, is titled the “Special Reconnaissance Service”.

The documents indicate that the GRU exerts direct control over the recruitment and grading process – sending its own officers to conduct exams, approve candidates and oversee placements. The picture that emerges is of a programme where the distinction between professor and handler and between teaching and recruitment is blurred.

The department is led by lieutenant colonel Lt Col Kirill Stupakov, a signals intelligence officer who, according to the documents, signed a three-year contract in 2022 with GRU Unit 45807, one of the agency’s key units. It is not clear if he is still in active service.

At Bauman, Stupakov’s subjects include training students to master electronic eavesdropping and covert surveillance. PowerPoint slides, apparently designed to accompany his lectures and viewed by the consortium, amount to a catalogue of deception: a smoke detector that is in fact a camera, a device that sits undetected between a keyboard and a computer logging every keystroke, a monitor cable that is also a silent screenshot machine storing its captures on a hidden flash drive.

Another teacher mentioned in the documents is Viktor Netyksho, a western-sanctioned major general who commanded Unit 26165 – a hacking group known as Fancy Bear – whose officers were indicted by the US Department of Justice for interfering in the 2016 presidential election.

Among the core courses is one titled “Defence against technical reconnaissance”. Over 144 hours across two semesters, students are taught the full toolkit of modern hacking, including password attacks, software vulnerabilities and so called trojans – malicious programs disguised as legitimate software that can grant unauthorised access to a system.

To pass the course, students are required to carry out “practical penetration tests”, while one module is devoted entirely to computer viruses. As part of the assessment, they must develop one themselves.

Students are also taught the structure and organisation of US and British military intelligence agencies. Separate sessions cover the use of western intelligence in the war in Ukraine, and the development of enemy reconnaissance and strike drones on the Ukrainian battlefield.

Apart from hacking tasks, the curriculum also covers information warfare. Advanced students must complete a seminar on developing a disinformation campaign, the documents suggest, tasked with creating a social media video using “manipulation, pressure and hidden propaganda”.

Students are taught the mechanics of psychological manipulation and how to impose a “correct” perception of information on an audience.

The teaching materials, meanwhile, saturate students with Kremlin orthodoxy: the war in Ukraine was “inevitable”; “nationalists and neo-Nazis” are in power there; Russians in the Donbas face “genocide”, backed by European countries.

Western intelligence services have grown increasingly vocal about the scale of Russian cyber-activity in recent years.

In a report published in February, the Dutch intelligence services warned that Russia was increasing hybrid activities across Europe, combining cyber-attacks, sabotage and influence operations targeting critical infrastructure.

On 15 April, Sweden’s minister for civil defence, Carl-Oskar Bohlin, publicly accused Russia of regularly carrying out destructive cyber-attacks against EU institutions.

From lecture hall to Sandworm

The documents suggest that among the 69 students who graduated from Department 4 in spring 2024 was Daniil Porshin, who had spent six years at Bauman maintaining near-perfect grades while playing for the faculty football team. Upon graduation, he was assigned to Fancy Bear.

Not every student makes the cut: the files show that dozens have been dismissed or failed to graduate, and the assessments of some students, written by the senior GRU officers who oversee the programme can be withering. “Insufficient understanding of how to carry out a remote network attack,” reads one evaluation.

Many are deemed worthy of work inside the GRU, however: 15 others from Porshin’s cohort were similarly directed into GRU units.

Among them was a student who took up his first posting that summer, 900 miles (1,500km) from Moscow at Unit 74455 in the Black Sea town of Anapa – one of Russia’s most popular holiday resorts, and home to the hacker unit known as Sandworm by western governments.

Sandworm has been accused by western intelligence agencies of unleashing some of the most destructive cyber-attacks of the past decade including targeting Ukraine’s power grid in 2015, Emmanuel Macron’s French presidential campaign in 2017, the South Korean Winter Olympics in 2018, and the British investigation into the Salisbury nerve agent poisoning.

The consortium sent requests to comment on the allegations to Bauman University, and to Netyksho, Stupakov and Porshin, but had not received a response at the time of publishing.

As the war in Ukraine continues, intelligence experts suggest that Russia is ramping up its “hybrid” attacks on European allies of Ukraine, attempting a broad campaign of interference and sabotage to cause havoc in the west while remaining deniable and not crossing the threshold that could trigger a military response.

Hacking and cyber-attacks have been a key part of this strategy and the documents suggest the Bauman programme shows no signs of slowing. The latest cohort of trainees will not graduate until the end of the 2027 academic year.

While the trove of documents represent an unprecedented insight into the secretive and systematic training programme for Russia’s cyber-agents, insiders said it was only one part of the picture. Another Russian university, Mirea, was even more crucial in training hackers, according to the former defence official.

“Bauman is one of a handful of elite universities used to identify gifted students for recruitment into military and intelligence structures,” said the source.