A Russian-speaking hacker turned Google's Gemini CLI into his botnet co-pilot

Key points

• A Russian-speaking attacker known as "bandcampro" used Google's Gemini CLI, a free open-source AI assistant, to help operate a small malware network between April 21 and May 19, according to Trend Micro.
• Gemini assisted across more than 200 sessions and offered unprompted improvements at least 59 times.
• Eight computers at a dental clinic were infected and the OpenDental patient database was accessed.
• From a single typed instruction, Gemini migrated the entire command-and-control setup to new servers in about six minutes.
• The whole toolkit fit in three plain text files totalling roughly 5 KB.

This is one of the more novel abuse cases I've seen in a while, and also one of the more mundane. A criminal used an AI coding assistant the way the rest of us use it: to save typing.

Researchers at Trend Micro published logs showing that a Russian-speaking attacker, tracked as "bandcampro," ran a small botnet, meaning a group of computers secretly controlled by a criminal, largely by chatting with Google's Gemini CLI. The CLI is a free command-line tool from Google that lets developers talk to the Gemini AI model from a keyboard. BleepingComputer first reported the story. We reported in June on Google taking Gemini-powered phishing operators to court, and this case shows the same model being bent to uglier ends with far less effort.

What did the attacker actually do with the AI?

He treated it like a junior colleague who never sleeps.

Across more than 200 sessions between April 21 and May 19, the attacker asked Gemini which infected machines were online, told it to list files on specific computers, and had it generate fresh links for infecting new victims. He wrote requests in plain language. The AI wrote the code.

To sidestep Google's safety rules, the attacker fed Gemini a short setup file telling it to act as an "authorized penetration tester," a security professional hired to legally probe systems. That framing was enough to make the model skip its usual warnings and quietly save any passwords it encountered.

One victim was a dental clinic. Eight of its computers were infected, and the attacker used Gemini to reach into OpenDental, the software managing the clinic's patient records. OpenDental hasn't appeared in our coverage before this case, which tells you something about how rarely it sits in the threat spotlight.

The six-minute server move

Gemini's most striking performance was a full server migration. The attacker typed four words: "Study the C2 migration." C2 is short for command-and-control, the servers criminals use to send orders to infected machines.

Gemini read the guide the attacker had prepared, packaged up the server code, launched a new instance on a rented virtual machine, configured a Cloudflare tunnel to conceal it, and began debugging. Total time: about six minutes.

When infected computers refused to reconnect, the AI diagnosed the problem: the old server was still competing for their attention. The attacker shut it down; the bots came back.

How sophisticated was any of this?

Not very. That's the interesting part.

The entire operation lived in three plain text files totalling around 5 KB, smaller than a single photo on a phone. The malware had no obfuscation, no evasion tricks, nothing clever. It was a Python web server running in memory with PowerShell scripts checking in every five seconds. Persistence relied on scheduled tasks, WMI subscriptions, and registry entries, all textbook techniques.

This isn't some exotic AI threat. It's old-school malware plumbing with a chatbot handling the boring bits.

The attacker also tried using Gemini to guess WordPress passwords and to sift through stolen 1Password vaults for reusable credentials. The second effort failed because the session ran so long the AI lost track of what it was doing.

Gemini did refuse once: when asked to build a self-spreading "agent-bomb," it declined. The attacker shrugged and moved on.

Google hadn't responded to requests for comment at time of writing.

Should you worry?

The honest answer is: not about this specific attacker, who was running a tiny operation with unsophisticated tools. Worry instead about what happens when someone applies the same AI-assisted workflow to malware that actually tries to hide. The efficiency gain is real, and the barrier to entry just got lower.