Leaked Bauman files name the GRU department that fed graduates into APT28 and Sandworm

The staffing numbers are worth walking through first. Roughly 250 career and reserve students passed through Department No. 4 over six academic years ^[11], which averages about 42 per intake ^[21]. Researchers estimate that 10 to 15 students each year were selected for GRU-related assignments before graduating ^[12], so 60 to 90 people across the six years, between a quarter and a third of everyone who went through ^[22]. Those are staffing numbers, and they hold across six consecutive cohorts.

The curriculum tells you what the graduates were built to do. Course materials define "information-technical weapons" as tools and methods designed to alter, destroy, copy, block, or manipulate information ^[13]. Red-team and blue-team functions are taught as one discipline rather than two tracks ^[14]. Technical protection instruction covered cryptography and steganography, code analysis and intrusion detection, hardware inspection, the discovery of physical implants, and the identification of undocumented device functions ^[15]. DomainTools also flags a malware-analysis and threat intelligence program in the files that had not previously been reported ^[16]. One advanced practical assignment required a social-media video built around what the materials called "manipulation, pressure, and hidden propaganda" ^[7]. It counted as coursework.

Provenance deserves separating from content. The records run through 2025 and cover academic and administrative material ^[9]. A DarkForums user known as "Losyash" may have shared the data, and it has not been confirmed that the account obtained it in the first place ^[17]. What holds the reading up is that two sets of eyes worked the same corpus: the consortium of The Insider, The Guardian, Le Monde, Der Spiegel, Delfi, VSquare and FRONTSTORY.PL ^[4], and DomainTools researchers analysing the files independently ^[5].

None of this changes a patch queue: the files carry no indicators and no new vulnerability, but what they do change is the resolution of attribution. Unit staffing has generally been inferred from tooling and tradecraft overlap; here there is a department inside Bauman's Military Training Center that does not appear on the university's public org chart ^[10], dated cohorts, and at least one named individual. Reporting places graduates in Military Unit 26165, associated with APT28 ^[2], and Unit 74455, associated with Sandworm ^[2], and identifies Aleksei Kondrashov, a 2024 graduate, as linked to 74455 ^[3]. Major General Viktor Netyksho sits in the department's teaching and oversight structure, having commanded Unit 26165 and the 85th Main Special Service Center ^[18]. He was one of 12 GRU officers indicted in the United States in 2018 over interference in the 2016 presidential election ^[19].

Put together, the finding takes a clear shape. A unit whose operators have been tracked as Fancy Bear, Sofacy and STRONTIUM for a decade ^[20] draws from an accredited engineering faculty with a known intake rate, known instructors, and a syllabus that trains intrusion and influence work side by side ^[6]. Planning assumptions about attrition, burn rates from sanctions and indictments, and how fast these units regenerate capability now have a number attached to them.