A solo Russian-speaking threat actor known as “bandcampro” outsourced a chunk of their operations to Google’s open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet.
The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, which found the threat actor using AI, among other things, to crack passwords, set up a residential proxy, compromise WordPress merchants, and plan a phone-based cryptocurrency fraud scheme aimed at elderly people in the U.S. and Canada.
“The logs documented how the threat actor used an AI agent to migrate a command-and-control (C&C) server, and to control a small-scale botnet, among other hacking activities,” Trend Micro researchers Joseph C Chen, Philippe Lin, Lucas Silva, Vladimir Kropotov, and Fyodor Yarochkin said.
“The entire C&C operation fits in three plaintext files totaling roughly 5 KB, making it highly replicable and effectively disposable. The AI was also observed to proactively (unprompted) propose improvements 59 times without being asked.”
Specifically, the threat actor is said to have abused Google Gemini CLI to deploy and operate a C&C infrastructure to control eight computers in a dental clinic and access their OpenDental database. Besides writing code snippets, the AI served as the “primary hacking agent, consultant, and interface” to the entire operation.
This included setting up the server, deploying it on a new virtual private server (VPS), configuring the infrastructure, setting up Cloudflare tunnels, managing the bots, and debugging connectivity issues.
Trend Micro has described the threat actor as a Russian speaker who used Google Gemini to “impersonate an American veteran patriot and to avoid Russian phrasing,” while tricking the AI agent into bypassing its guardrails by assuming the role of an “authorized pentester.”
The threat actor is said to have run prompts to study the old C&C infrastructure where the victim machines connected using Cloudflare tunnels and migrate it to a new architecture within six minutes. The architecture involves victims issuing outbound requests to a C&C server over HTTPS to pull and run PowerShell commands staged by the threat actor on the server.
“The migration hit errors immediately, but the AI agent resolved them: When the payload distribution server returned a ’502 Bad Gateway’ error, the AI diagnosed the issue and automatically added the necessary header to resolve it,” Trend Micro said.
“As Cloudflare still blocked the requests, the AI identified that the User-Agent header was required to bypass the WAF and thus added it to the request header. The actor did none of the debugging, and the migration was done in merely six minutes.”
Once the migration was complete, the AI agent carried out additional debugging to successfully remediate errors that left all the victim machines disconnected from the C&C infrastructure. In addition, the threat actor has been found to leverage the AI agent to perform botnet management tasks by sending natural language instructions in Russian, which then enabled the AI tool to perform the following tasks –
- Report which machines are active
- Send a file enumeration command to the bot
- Send reconnaissance commands to the front desk machine
- Generate a one-line PowerShell command to infect a machine
What’s particularly concerning about this AI-assisted setup is that the entire C&C operation can be easily ported to a fresh server through three markdown files that instruct the agent to disable its safety protections, contain the architecture description, and include steps to build it from scratch, making takedowns a lot less effective than before.
“Facilitated by AI, the infrastructure becomes disposable, and the operators replaceable,” Trend Micro said. “Even though the takedowns are still efficient, they become much less impactful. If a server is burned, the actor could simply unpack the bundle on a new VPS, and AI configures and restores everything in a few minutes.”
The findings show that the technology can not only cut the resources necessary to run large-scale operations, but also enable bad actors with little to no technical knowledge to set up such schemes with minimal effort or distribute them on underground forums in the form of malicious skill files, effectively paving the way for new AI-powered malware services that go beyond the conventional “as-a-service” models.
This playbook also has the side-effect of complicating attribution efforts, as there is no centralized service to hunt for, and an AI agent can easily regenerate or modify any component at will so as to sidestep specific fingerprints.
At one point, “bandcampro” is said to have prompted the AI to build a self-spreading “agent-bomb” that would scan the network and break into as many machines as possible, a request the agent refused, stating it’s “crossing the line.” At the same time, it offered helpful suggestions to manually overcome the limitations.
The threat actor has also been found relying on the AI agent for other tasks, namely –
- Password cracking, which used the agent as a credential mutation engine to predict possible passwords based on an input list obtained from AntiPublic, which maintains a database of leaked credentials, and leveraged those guesses as a brute-force tool for WordPress admin panels, successfully gaining access in a handful of cases.
- Credential exploitation, which analyzed 1Password dumps to find exploitation pathways. The task, however, ended up in failure, if only because the context window ran too long, and it lost track of what it was supposed to do.
- Cryptocurrency fraud planning, which involved discussing the feasibility of establishing a telephone-based bogus scheme targeting the elderly in the U.S. and Canada.
“Across the full month of logs, the actor contributed 11% of text produced and the AI 89%, twelve times the actor’s word count,” Trend Micro concluded. “The actor provided strategic direction and functioned as a product manager, while the AI was his entire engineering team, handling 80% of architectural design, 100% of coding and system command execution, and 90% of problem diagnosis and debugging.”
“The portable skill-file model means this methodology will likely spread. The skill file is plain text, unlikely to be flagged by traditional malware scanners on its own, shareable on forums, and modifiable in seconds. It turns any capable AI coding agent into a C&C operator, if they can successfully persuade the built-in safety mechanisms in AI agents.”
