A Russian-speaking hacker turned Google's Gemini CLI into his botnet co-pilot

Key points

• A Russian-speaking attacker known as "bandcampro" used Google's Gemini CLI, an open-source AI assistant, to help run a small malware network from April 21 to May 19, according to Trend Micro.
• The AI helped the attacker across more than 200 sessions and offered unprompted improvements at least 59 times.
• The victims included a dental clinic where eight computers were infected and the OpenDental patient database was accessed.
• Gemini migrated the entire command-and-control setup to new servers in about six minutes from a single instruction.
• The whole toolkit fit in three plain text files totalling roughly 5 KB.

This is one of the more novel abuse cases I have seen in a while, and also one of the more mundane. A criminal used an AI coding assistant the way the rest of us use it: to save typing.

Researchers at Trend Micro published logs showing that a Russian-speaking attacker, tracked as "bandcampro," ran a small botnet, meaning a group of computers secretly controlled by a criminal, largely by chatting with Google's Gemini CLI. The CLI is a free command-line tool from Google that lets developers talk to the Gemini AI model from their keyboard. It was designed to help people write code faster. It also, it turns out, helps people write malware faster.

The story was first reported by BleepingComputer.

What did the attacker actually do with the AI?

He treated it like a junior colleague who never sleeps.

Across more than 200 sessions between April 21 and May 19, the attacker asked Gemini which infected machines were online, told it to list files on specific computers, and had it generate fresh links used to infect new victims. He wrote his requests in plain language. The AI wrote the code.

To get past Google's safety rules, the attacker fed Gemini a short setup file telling it to act as an "authorized penetration tester," which is a security professional hired to legally break into systems. That framing was enough to make the model skip its usual warnings and quietly save any passwords it came across.

One victim was a dental clinic. Eight of its computers were infected, and the attacker used Gemini to reach into OpenDental, the software the clinic used to manage patient records and appointments.

The six-minute server move

The most striking moment in the Trend Micro report is a server migration. The attacker typed four words: "Study the C2 migration." C2 is short for command-and-control, the servers criminals use to send orders to infected machines.

Gemini read the guide the attacker had prepared, packaged up the server code, launched a new server on a rented virtual machine, set up a Cloudflare tunnel to hide it, and started debugging. Total time: about six minutes.

When the infected computers refused to reconnect, the AI worked out that the old server was still competing for their attention. The attacker shut the old one down. The bots came home.

How sophisticated was any of this?

Honestly, not very. That is the interesting part.

The entire operation lived in three plain text files totalling around 5 KB. That is smaller than a single photo on your phone. The malware itself had no disguises, no anti-analysis tricks, nothing clever. It was a Python web server sitting in memory and PowerShell scripts checking in every five seconds. The persistence tricks, meaning the ways malware stays on a machine after reboot, were textbook: scheduled tasks, WMI events, and registry entries.

Compare it to a classic web attack and you get the flavour. This is not some exotic new AI threat. It is old-school malware plumbing with a chatbot bolted on to do the boring bits.

The attacker also tried using Gemini to guess WordPress passwords and to sift through stolen 1Password vaults for reusable logins. That second effort failed, oddly, because the AI lost the plot over such a long session and forgot what it was doing.

Gemini did refuse once, when asked to build a self-spreading "agent-bomb." The attacker shrugged and moved on to other tasks.

Google had not responded to requests for comment at time of writing.