Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
Summary: A solo Russian-speaking threat actor tracked as "bandcampro" used Google's open-source Gemini CLI to migrate and operate command-and-control infrastructure controlling eight computers at a dental clinic and accessing their OpenDental database, according to Trend Micro's analysis of 200 Gemini CLI session logs from March 19 to April 21, 2026. The AI agent completed the C&C migration in six minutes, diagnosing a 502 Bad Gateway error and adding a User-Agent header to bypass Cloudflare's WAF, while the actor contributed 11% of the text in the logs and the AI 89%.
What you should know: The entire C&C operation fits in three plaintext markdown files totaling roughly 5 KB, so a burned server can be rebuilt on a new VPS in minutes - meaning takedowns still work but matter far less, and there is no centralized service left to attribute the activity to.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026