A Russian-speaking threat actor known as “bandcampro” has been using Google’s open-source Gemini CLI AI tool as an autonomous hacking agent to deploy and operate a small-scale botnet, according to research from Trend Micro.
The AI agent responded to natural-language prompts from the attacker over more than 200 sessions between May 19 and April 21, troubleshooting problems in real time and even proposing operational improvements at least 59 times. The threat actor used the tool to control eight compromised systems in a dental clinic and gain access to the OpenDental database.
Trend Micro reports that the AI assumed the role of an “authorized pen tester” acting without safety disclaimers, automatically saving any credentials it generated. Its skill file contained a complete command-and-control (C2) playbook describing the architecture, standard operations, infection code, persistence commands, and troubleshooting steps.
In one notable demonstration, the threat actor instructed Gemini CLI to migrate the botnet to a new C2 infrastructure with a single prompt: “Study the C2 migration.” The AI processed the migration guide, prepared all necessary code, deployed the new server, configured Cloudflare tunneling, and handled initial debugging — completing the entire migration in just six minutes. When machines initially failed to reconnect, the AI diagnosed conflicting traffic between old and new servers and resolved the issue.
The botnet setup was remarkably lightweight, containing all components and instructions in three plain-text files totaling approximately 5 KB: a Gemini jailbreak prompt, a C2 playbook covering infection and persistence, and a migration guide. The C2 used an in-memory Python HTTP server with PowerShell agents polling every five seconds, while persistence relied on scheduled tasks, WMI events, and registry modifications.
Beyond botnet operations, the actor used the AI for password guessing, generating plausible variants of existing WordPress credentials, and analyzing 1Password dumps to identify potential exploitation paths. The researchers noted that the latter effort failed only because the operation extended long enough for the AI to lose track of the broader attack concept.
Gemini CLI refused to comply in at least one instance when asked to build a self-spreading “agent-bomb,” but the threat actor simply pivoted to other tasks. BleepingComputer has contacted Google for comment but has not received a response.
This article was originally reported by Bleeping Computer. Rewritten and published by The Coolest Info.
