Executive Summary
A Russian-speaking actor called bandcampro used Google's open-source Gemini CLI to run operations including cracking passwords, setting up proxies and controlling a botnet of eight dental clinic PCs, according to 200 session logs.
What Happened
A solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet. The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, which found the threat actor using AI, among other things, to crack passwords, set up a residential
Affected Products
- Google Gemini CLI
Vulnerability / Attack Technique
Attacker outsourcing operations to an AI CLI
Technical Mechanism
The attacker issued tasks to Gemini CLI, which carried out password cracking, infrastructure setup and botnet control.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
A solo attacker scaled up with an AI assistant. RealGround analysis: small healthcare practices are reachable targets for AI-assisted operators.
Recommended Controls
- Patch and monitor practice PCs
- Use strong unique passwords and MFA
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/russian-speaking-hacker-uses-google.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.