A Russian-speaking cybercriminal allegedly turned Google’s Gemini CLI into an operational hacking agent, using natural-language instructions to deploy, troubleshoot, migrate, and manage a live command-and-control botnet linked to eight compromised computers at a dental clinic.
Trend Micro’s investigation offers a rare look at how an agentic AI coding tool can move beyond generating snippets of malicious code and become the primary technical operator behind an active cybercrime campaign.
TL;DR
- Trend Micro analyzed more than 200 Gemini CLI sessions belonging to a threat actor tracked as “bandcampro.”
- Gemini CLI reportedly handled 89% of the written work and completed a live command-and-control migration in six minutes.
- The AI deployed infrastructure, debugged failures, managed infected systems, and made 59 unsolicited operational suggestions.
TrendAI Research analyzed more than 200 Gemini CLI session logs from March 19 to April 21, 2026, documenting how the actor used Google’s open-source command-line AI tool to operate a small botnet and pursue other cybercriminal activities.
The botnet controlled eight computers inside a dental clinic and provided access to its OpenDental database. Rather than entering technical commands manually, the actor issued requests in Russian, while Gemini CLI wrote code, deployed servers, configured Cloudflare tunnels, checked infected machines, and diagnosed connectivity issues.
The most striking episode began when the actor entered a simple instruction: “Study the C2 migration.”
Gemini CLI read a migration guide, assembled the required server code and payloads, launched a command-and-control server on a virtual private server, and configured a Cloudflare tunnel. When the infrastructure encountered a “502 Bad Gateway” error and firewall interference, the AI diagnosed the problems and modified the request headers.
Trend Micro said, “The actor did none of the debugging, and the migration was done in merely six minutes.”
After the migration, the AI discovered that no victim machines had reconnected. It identified a split-brain configuration in which traffic was being distributed between the old and new servers, instructed the operator to shut down the former infrastructure, restarted the replacement server, and confirmed that the bots were online again.
How Much Of The Attack Did Gemini CLI Handle?
Trend Micro calculated that Gemini CLI generated 89% of the text across the month-long activity window, around 12 times the actor’s contribution. The researchers attributed 80% of the architectural work, all coding and system-command execution, and 90% of diagnosis and debugging to the AI.
The AI also made 59 unprompted recommendations during the command-and-control migration, showing that it was not merely following instructions but proactively proposing operational improvements.
The entire setup was stored in three plain-text files totaling roughly 5KB. These included a jailbreak prompt presenting the AI as an authorized penetration tester, a botnet operations playbook, and a migration guide capable of restoring the infrastructure on another server.
Trend Micro warned that this makes malicious infrastructure increasingly disposable. Once a server or indicator is blocked, an operator may be able to ask an AI agent to regenerate components, change filenames, alter registry keys, and rebuild the operation within minutes.
Topics For More Insights
Did Gemini’s Guardrails Stop The Actor?
The safeguards worked at least once. When the actor requested a self-spreading “agent-bomb” capable of scanning networks and infecting machines, Gemini refused, stating that the request crossed a line.
However, the logs indicate that this refusal did not prevent the broader operation. The actor switched to other tasks, while the AI continued assisting with botnet management, password mutation, WordPress attacks, credential analysis, reconnaissance, and fraud planning.
Google had already said in February 2026 that malicious actors were using Gemini across attack stages ranging from reconnaissance and phishing to command-and-control development and data exfiltration. The company said it had disabled accounts and infrastructure associated with documented abuse and introduced targeted defensive measures.
The Gemini CLI team also announced stronger detection for policy-violating use cases in March 2026. Google had not provided a direct response to the newly disclosed bandcampro case when supporting coverage was published.
