A Russian-speaking threat actor known as “bandcampro” used Google’s open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet.
The AI agent responded to the attacker’s prompts, troubleshooting problems on the fly and even proposing operational improvements at least 59 times.
In more than 200 sessions between May 19 and April 21, the threat actor worked with the AI tool to deploy and operate an infrastructure that controlled eight systems in a dental clinic and to get access to the OpenDental database.
The AI agent assumed the role of an “authorized pen tester” acting without safety disclaimers and automatically saved any credentials.
Its skill file contained the command-and-control (C2) playbook, complete with a description of the architecture, standard operations, infection code, commands for persistence, and troubleshooting steps.
AI controlling the botnet
Trend Micro researchers say that the threat actor used Gemini CLI to migrate the botnet to a new C2 infrastructure. Starting from a single instruction that read “”Study the C2 migration,” the AI processed the guide and prepared all the steps and code necessary for the process.
The AI migrated the C2 infrastructure, handling the architecture, coding, VPS deployment, Cloudflare configuration, and initial debugging in just six minutes.
“The AI read the migration guide, then prepared a migration bundle, a small archive of server code, payloads, and the skill file. It then unpacked the bundle, launched the C&C server on a VPS, and brought up the Cloudflare tunnel,” Trend Micro says.
When machines initially failed to reconnect, the AI diagnosed conflicting traffic between the old and new servers, and after the actor shut down the old server, all bots reconnected.
Source: Trend Micro
Daily operation logs show that the threat actor continued to manage the botnet entirely through natural-language requests, asking which machines were online, listing files on particular computers, and generating infection links.
Source: Trend Micro
From a technical standpoint, the botnet setup was remarkably lightweight, containing all components and instructions in three plain-text files totaling roughly 5 KB.
These contained a Gemini jailbreak prompt, a C2 playbook covering infection, persistence, and troubleshooting, and a migration guide for rebuilding the infrastructure.
The C2 used an in-memory Python HTTP server and PowerShell agents that polled it every five seconds, and persistence relied on scheduled tasks, WMI events, and registry modifications, depending on privileges.
The malware itself was rather unsophisticated, according to Trend Micro, as it did not benefit from obfuscation, packing, or evasion mechanisms.
Beyond the botnet, the actor allegedly used AI for password guessing, generating plausible variants of existing passwords for WordPress portals, and analyzing 1Password dumps to find exploitation alleys.
The researchers say that the latter failed only due to the operation extending for long enough that the AI lost track of the broader attack concept.
The retrieved logs show that Gemini refused to comply in at least one case, when it was asked to build a self-spreading “agent-bomb,” but this simply made the threat actor try out other tasks instead.
BleepingComputer has contacted Google for a comment on this example of Gemini CLI abuse, but we have not received a response as of publishing.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
