Russia Built a Factory for Hackers That Just Leaked

everyone tracks fancy bear and voodoo bear like they are some kind of treacherous weather systems. the threat actor appears, causes some level of damage, and then we name the storm. a leak out of a russian university just showed where these so-called storms are actually developed. russia has a school for it.

documents from bauman moscow state technical university, one of russia's top technical institutions, expose a unit called department no. 4. publicly, it was invisible. it was not in the university's public org chart. the reality is it was a military cyber academy. a kind of special-training program teaching offensive cyber operations, electronic reconnaissance, information warfare, and intrusion tradecraft. its best students moved straight into gru units.

researchers tied graduates and the broader program directly to military unit 26165. this is the unit where fancy bear is housed. also unit 74455, where voodoo bear sits. that is the threat actor responsible for the globally chaotic notpetya "ransomware" attack. the records also connect the pipeline to unit 29155.

one 2024 graduate was even assigned to the voodoo bear unit by name. aleksei kondrashov went from department no. 4 into military unit 74455. viktor netyksho is the officer overseeing students, and he was a former commander of the fancy bear unit. this is the same man the us indicted in 2018 over election interference from 2016. the people running the classroom are the very same people running the offensive cyber operations.

to be clear, the leak shows where graduates were placed, not proof any specific person carried out any specific attack. trained at the school, and assigned to the unit, is not the same as pulling the proverbial trigger on a named operation. treat it as you should, as a mere pipeline document in a treasure trove of existing documents. this is not some confession. even the leak itself is peculiar, arriving through a murky forum account with almost no history. even the provenance deserves skepticism.

the training pipeline is the more interesting story. roughly 10 to 15 students a year are steered toward gru postings, some before they even graduate. that may not sound like a large number of students. but it is not supposed to. it is a steady drip of trained and skilled operators, every year, forever.

the 2024 class makes the pipeline visible. 69 students graduated. at least 16 of them were reportedly sent into gru units, including fancy bear and voodoo bear. this is not a hiring spree. nor is it supposed to be. rather, it is a highly reliable conveyor belt that has likely been running for a long time, and will keep running long after any single operator is burned.

this is the part defenders and policymakers keep missing. we treat russian cyber power as a set of named groups. sanction the unit. indict the officer. burn the malware. expose the operator. all of that is real work, and all of it targets the output. this leak shows the input. you cannot sanction a curriculum. you cannot indict a syllabus. you cannot burn a lesson plan taught to a new class every september.

think about what that means for how this fight actually goes. every operator the west identifies, names, and neutralizes is a graduate. behind every graduate is a classroom. behind the classroom is a doctrine. and behind the doctrine is a state that decided years ago to industrialize the production of cyber talent the way it once industrialized tanks.

fancy bear and voodoo bear are not the threat. they are the product. the factory is the threat. the factory does not care that you caught this year's model. and more to the point, fancy bear and voodoo bear continue to wreak havoc with impunity.

that is the uncomfortable lesson hiding in a pile of leaked exam records. we have been fighting the graduates and calling it the war. the war was decided in the admissions office.

burn one operator, another one graduates. expose one unit, another class is already taking the exam.

the west keeps hunting bears. russia keeps teaching them how to hunt.