Department No. 4 and the Bauman material
The leaked training records center on a university-linked program identified as Department No. 4 and material originating from Bauman. According to the documents, Department No. 4 is part of a recurring pathway that moves students from university recruitment into military and intelligence roles where they receive both technical and ideological preparation. The records present Department No. 4 as a formal element of force generation for Russia’s cyber and intelligence apparatus rather than an informal recruiting ground.
Force-generation across the General Staff, the GRU, and the 8th Directorate
The files describe a force-generation mechanism that spans several General Staff components, explicitly naming the GRU, the Main Operational Directorate, and the 8th Directorate. The 8th Directorate is identified in the materials as associated with protected communications, cryptography, and information security. Together, these placements in the documents portray a coordinated institutional pipeline that funnels trained personnel into multiple technical and operational missions.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAleksei Kondrashov and Military Unit 74455 (Sandworm)
The reporting links a 2024 Department No. 4 graduate, Aleksei Kondrashov, to Military Unit 74455, widely known as Sandworm. The materials note that Military Unit 74455 has been associated with destructive cyber activity against Ukraine and other targets, including the 2017 NotPetya attack. The records themselves caution that documented unit placements do not, on their own, establish that every listed graduate participated in a named operation; assignments in the files are described as reported unit placements rather than proof of individual operational involvement.
Implications for defenders: a combined-threat model
The leak underscores a consolidation in how operations might be organized and sustained. For defenders, the records reinforce the need to track Russian operations as a combined threat: the documents link personnel pipelines and overlapping doctrine to a range of activity types, including espionage, destructive activity, military reconnaissance, technical surveillance, and influence campaigns. That single-sentence prescription in the source material is explicit about defenders needing to view these modes of activity as potentially connected through shared recruitment and preparation processes.
What this means for researchers, defenders, and policymakers
- Researchers: The exposure of Department No. 4 gives analysts "a clearer lens" to trace how the GRU sustains cyber capability beyond established labels such as APT28 and Sandworm, allowing studies to follow reported unit placements and institutional links rather than relying solely on brand-name threat attributions.
- Defenders (security teams and incident responders): The records recommend treating activity across espionage, destructive operations, reconnaissance, surveillance, and influence as potentially related; defenders should therefore map personnel and doctrinal overlaps as part of threat modeling rather than treating each incident in isolation.
- Policymakers and regulators: The material suggests Moscow has formalized a recurring pathway from university recruitment to military service, combining technical training and ideological preparation; those who set policy or oversight may want to consider that recruitment and training mechanisms are an integral part of how cyber capacity is generated.
The documents do more than identify individual names and placements; they shift the frame from a mosaic of branded threat actors to an institutional system that channels graduates into a spectrum of state cyber activities. The explicit linkage of a 2024 Department No. 4 graduate to Military Unit 74455 sharpens that shift: it is a concrete example inside the files that illustrates how the records map people into established units associated with destructive operations. Whether other documented placements in the material will yield similar, verifiable ties to operations remains a practical next step for researchers and defenders to pursue.
