Leaked Russian cyber-operations training records describe GRU-linked force-generation pipeline

A set of leaked training records from a Moscow technical university describes a formalized force-generation pipeline feeding several components of Russia’s General Staff, including the GRU, its Main Operational Directorate, and the 8th Directorate, which handles protected communications, cryptography, and information security.

The materials link Aleksei Kondrashov, a 2024 graduate of Department No. 4, to Military Unit 74455—commonly known as Sandworm—via reported unit placement. Sandworm has been previously associated with destructive cyber activity against Ukraine and other targets, including the 2017 NotPetya attack.

The documents do not establish that every listed graduate participated in a named operation; Schneier emphasizes that assignments should be described as reported unit placements rather than proof of individual operational involvement.

The leak reframes Russia’s cyber capability as an institutional system rather than a loose collection of high-profile threat groups, indicating a recurring pathway from university recruitment to military service where students receive supervised technical and ideological preparation before entering intelligence, cyber, and security roles.

For defenders, the exposure underscores the need to track Russian operations as a combined threat: espionage, destructive activity, military reconnaissance, technical surveillance, and influence campaigns may draw on related personnel pipelines and overlapping doctrine.

The disclosure also offers researchers a clearer lens for understanding how the GRU sustains cyber capacity beyond the familiar APT28 and Sandworm brand names.