🇷🇺🚨 LEAKED TRAINING MATERIALS EXPOSE RUSSIA'S PIPELINE FOR DEVELOPING MILITARY CYBER OPERATORS A major leak from Bauman Moscow State Technical University is providing researchers with a rare look inside how Russia may systematically recruit, train and funnel technical personnel into military intelligence and cyber operations. The leaked records come from Bauman University's Department No. 4 and describe training associated with multiple components of Russia's General Staff, including: * GRU military intelligence * Main Operational Directorate * 8th Directorate — associated with protected communications, cryptography and information security The material suggests something bigger than individual Russian hacking groups: A structured pipeline from university education → specialized cyber training → military service → intelligence and security roles. Students reportedly received preparation covering areas including offensive and defensive cyber operations, technical surveillance, information security and related military disciplines. One particularly significant finding: Reporting linked 2024 Department No. 4 graduate Aleksei Kondrashov to Russian Military Unit 74455. That unit is widely associated with SANDWORM — one of Russia's most notorious state-linked cyber operations groups. Sandworm has been associated with destructive operations against Ukraine and other targets, including the devastating 2017 NotPetya attack. But there is an important intelligence caveat: ⚠️ A military-unit assignment does NOT prove that an individual participated in any specific cyber operation. The leaked records should therefore be interpreted as evidence of reported personnel pipelines and assignments — not automatic attribution of individual attacks. ⚠️ Analyst Note: Perhaps the most important takeaway isn't another connection to Sandworm or APT28. It's the infrastructure behind them. Threat intelligence often represents Russian cyber activity through recognizable actor names: APT28 Sandworm Fancy Bear Forest Blizzard But those labels describe operational manifestations. Behind them may exist a much larger institutional system continuously producing personnel with expertise spanning: Cyber operations → intelligence → reconnaissance → technical surveillance → information operations. That means understanding state-sponsored cyber threats requires looking beyond malware families and individual campaigns. We also need to understand how adversaries recruit, educate, train and replace the humans operating behind them. APT groups aren't simply threat-actor names. They are organizations supported by pipelines. Source: Bruce Schneier / Schneier on Security — September 1, 2026 schneier.com/blog/archives/2… #DDW #Russia #GRU #Sandworm #ThreatIntelligence