Russian-Speaking Hacker Leverages Google Gemini CLI for Botnet Control and Cybercrime Operations

A Russian-speaking hacker used Google Gemini CLI to control a botnet of eight dental clinic PCs, leveraging AI for command-and-control operations and cybercrime tasks. The AI assisted in server migration, botnet management, and credential exploitation, highlighting the growing threat of AI-powered malware infrastructure.

A solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet.

The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, which found the threat actor using AI, among other things, to crack passwords, set up a residential

Read original article