Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

A Russian-speaking threat actor known as 'bandcampro' leveraged Google's open-source Gemini CLI as an AI-powered hacking agent to control a botnet of eight dental clinic computers. The AI was used to autonomously set up and manage command-and-control infrastructure, debug connectivity issues, and perform tasks such as password cracking and botnet management. The operation, part of the 'Patriot Bait' campaign, demonstrates a novel use of AI to reduce operator effort, enable rapid infrastructure replication, and complicate attribution.

AI-extracted · verify before operational use