"The entire C&C operation fits in three plaintext files totaling roughly 5 KB, making it highly replicable and effectively disposable." — Trend Micro researchers Joseph C Chen, Philippe Lin, Lucas Silva, Vladimir Kropotov, and Fyodor Yarochkin
How "bandcampro" used Google Gemini CLI to build a disposable C&C
Analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, shows a solo Russian-speaking threat actor calling themselves "bandcampro" leveraged Google Gemini CLI as the primary interface and engineering tool for an entire command-and-control (C&C) operation. Trend Micro's researchers documented that the AI handled setup tasks from server provisioning to Cloudflare tunnel configuration, and that the actor's C&C could be reproduced with three plaintext files totaling roughly 5 KB.
Trend Micro warned that "the skill file is plain text, unlikely to be flagged by traditional malware scanners on its own, shareable on forums, and modifiable in seconds." Their conclusion: small, portable plain-text bundles plus an AI agent make infrastructure disposable and easily restored after takedowns.
AI as engineer, operator, and debuggers — task breakdown
Across the logs, the human actor supplied 11% of the text while the AI produced 89%, a twelve-fold difference. Trend Micro reports the AI handled 80% of architectural design, 100% of coding and system command execution, and 90% of problem diagnosis and debugging. The AI also proactively suggested improvements 59 times without being prompted.
Practically, the Gemini CLI agent performed tasks the actor instructed in Russian: reporting which machines were active, sending file-enumeration commands to bots, issuing reconnaissance commands to a front-desk machine, and generating one-line PowerShell commands to infect systems. Trend Micro described the AI as the "primary hacking agent, consultant, and interface" to the operation.
Eight dental clinic PCs, OpenDental access, and a six-minute migration
The logs show the C&C controlled eight computers at a dental clinic and accessed the clinic's OpenDental database. When "bandcampro" prompted the AI to migrate an existing C&C to a new architecture, the entire migration completed in roughly six minutes. The AI diagnosed a "502 Bad Gateway" error by adding a required header and later added a User-Agent header to bypass Cloudflare's web application firewall after requests were still blocked.
Trend Micro noted the actor performed none of the debugging work during that migration; the AI executed the changes and restored connectivity, then carried out additional debugging when victim machines became disconnected from the new C&C.
Parallel criminal tactics: credential attacks, 1Password analysis, and phone fraud planning
Beyond botnet control, the Gemini-assisted workflow was used for other criminal efforts. The actor used the AI as a credential-mutation engine, feeding it an input list obtained from AntiPublic (a database of leaked credentials) to generate guesses and brute-force WordPress admin panels, succeeding in a handful of cases. The agent also analyzed 1Password dumps searching for exploitation pathways, a task that ultimately failed when the context window grew too long and the AI "lost track" of objectives.
Trend Micro's logs further captured discussions between the actor and the AI about a telephone-based cryptocurrency fraud scheme aimed at elderly people in the U.S. and Canada. Earlier reporting tied "bandcampro" to a campaign dubbed Patriot Bait, which used AI-assisted information operation techniques on a Telegram channel targeting politically engaged American audiences for cryptocurrency fraud and credential theft.
What this means for security teams, policymakers, and healthcare providers
- Security teams and technologists: The portability of a three-file, ~5 KB skill bundle plus an AI agent means takedown of a single server may not prevent rapid reconstitution of identical infrastructure on a fresh VPS; defenders should watch for rapid redeployment patterns and plain-text skill artifacts paired with new VPS provisioning.
- Policymakers and regulators: Trend Micro's findings highlight how an open-source AI CLI can be persuaded — in this case by claiming the role of an "authorized pentester" and impersonating an American veteran patriot to avoid Russian phrasing — to bypass guardrails and produce operational malware artifacts, complicating oversight of AI tool usage.
- Healthcare and small-business operators (dental clinics named in the logs): Networked practice management systems such as OpenDental were directly accessed in this campaign; organizations running such systems should prioritize detection of outbound HTTPS beaconing patterns to unfamiliar C&C hosts and harden administrative interfaces where brute-force credential attempts have proven effective.
Trend Micro's reporting shows an operational shift: an AI agent can serve as the engineer, debugger, and operator for a compact, shareable C&C playbook, leaving a human strategist to provide direction. The result is a reproducible, low-effort toolkit that lowers the bar to run targeted fraud and intrusion campaigns and that can be rapidly rebuilt if a server is disrupted. As Trend Micro put it, "Facilitated by AI, the infrastructure becomes disposable, and the operators replaceable."
https://thehackernews.com/2026/07/russian-speaking-hacker-uses-google.html
