Leaked Russian Cyber-Operations Training Materials
This is interesting:
The records describe a force-generation mechanism for several General Staff components, including the GRU, Main Operational Directorate, and 8th Directorate, which is associated with protected communications, cryptography, and information security.
[…]
The reporting also linked a 2024 Department No. 4 graduate, Aleksei Kondrashov, to Military Unit 74455, widely known as Sandworm.
That unit has been associated with destructive cyber activity against Ukraine and other targets, including the 2017 NotPetya attack.
The reports do not establish that every listed graduate participated in a named operation; assignments should therefore be described as reported unit placements, not proof of individual operational involvement.
The Bauman material reframes Russia’s cyber capability as an institutional system, not merely a collection of well-known threat groups.
It suggests that Moscow has formalized a recurring pathway from university recruitment to military service, where students receive supervised technical and ideological preparation before entering intelligence, cyber, and security roles.
For defenders, the leak reinforces the need to track Russian operations as a combined threat: espionage, destructive activity, military reconnaissance, technical surveillance, and influence campaigns may draw on related personnel pipelines and overlapping doctrine.
The exposure of Department No. 4 also provides researchers with a clearer lens for understanding how the GRU sustains cyber capacity beyond the familiar APT28 and Sandworm brand names.
ResearcherZero • September 1, 2026 8:59 PM
@Bruce
This kind of information about the training and its methodology, recruitment and organizational structure and the institutional approach of the GRU for each of its departments and individual units is know to the intelligence services.
The problem that exists is convincing law enforcement, government officials and elected representatives that all of the GRU activities are part of a larger operational focus with clear objectives which target specific places, people, industries, sensitive information and critical infrastructure. This includes blueprints for top secret defense projects, contractors, interdiction of communication systems of law enforcement, government records, medical and education records, classified reports, political candidates, government departments and agencies.
Anywhere information is stored, or can be extracted, is a potential target when GRU operatives are attempting to identify a specific person, family or resource. They will walk right in and take it from where it is stored in broad daylight and operate openly. For more secure locations they may employ more covert measures. Typically there is a lot of “noise” in their operations, often accompanied with what might appear as sporadic and random acts of violence. None of it is random. All of it is well planned and serves a specific purpose.
Undeclared GRU agents will try and convince someone with access to information to hand it over using an innocent sounding excuse, or talk someone into performing an action using deception. They will pose as government employees or law enforcement, or infiltrate their ranks. Threats, intimidation, enticement, deception and compromise are common tactics.
Recruitment of assets is typically performed through inducement. Money, promotion, access.
Intimidation and neutralization is performed using, guns, explosives, poisons and drugs.
The tools of reconnaissance will be deployed in preparation for, or execution of activities.
The likelihood anyone working in a government department or agency, or servicing public institutions, will recognize a colleague is a foreign agent is low. Training to identify rogue employees or insiders is practically non-existent in most government departments, industries and contractors. Suspicion is countered through deflection and simple lies.
Law enforcement lacks training, education, resources and dedicated teams to identify and tackle covert activity. They have no procedures or protocols to respond when they do. Lack of training and preparedness leaves a gaping hole in public safety and national security.
Lack of preparedness and support creates fear for those facing novel experiences. Frightened law enforcement officers are ineffective officers. Likewise, so are officials, defense contractors, or members of the public service working in any area of government.