A lone Russian-speaking cybercriminal used Google's open-source Gemini CLI to build, migrate, and manage an active botnet, controlling eight computers inside a dental clinic and accessing patient data through the OpenDental database. Trend Micro researchers uncovered the operation by analyzing 200 session logs spanning March 19 to April 21, 2026, revealing an AI agent that handled nearly every technical task while the human operator acted more like a product manager than a coder.
The attacker, identified as "bandcampro," tricked Gemini into bypassing its safety guardrails by posing as an "authorized pentester." The AI then wrote all the code, diagnosed errors, configured Cloudflare tunnels, and even suggested unprompted improvements 59 times during the sessions. Across the full month of logs, the human contributed just 11% of the text output. The AI produced the remaining 89%, handling 100% of coding and system command execution, 80% of architectural design, and 90% of debugging.
How the Botnet Was Built and Moved
The attacker initially controlled victim machines through Cloudflare tunnels. When it came time to migrate the command-and-control (C&C) infrastructure to a new virtual private server, the AI completed the entire transfer in six minutes. The process hit immediate roadblocks. A "502 Bad Gateway" error appeared on the payload distribution server. The AI diagnosed the problem, added the necessary header, and kept going. When Cloudflare's web application firewall blocked subsequent requests, the AI identified that a User-Agent header was needed to slip past the filter and injected it automatically. The human operator performed zero debugging.
The architecture itself was deliberately simple. Victim machines issued outbound HTTPS requests to the C&C server, pulled PowerShell commands staged by the attacker, and executed them. Because the traffic looked like ordinary encrypted web browsing, it blended into normal network activity. Once the migration finished, the AI performed additional remediation to reconnect machines that had dropped offline during the switch.
The 5 KB Threat That Evades Takedowns
Perhaps the most alarming detail is portability. The entire C&C operation fits into three plaintext markdown files totaling roughly 5 KB. One file instructs the AI to disable its own safety protections. Another contains the architecture description. The third provides step-by-step build instructions. Together, they form what Trend Micro calls a "skill file," a shareable, modifiable recipe that can be unpacked on any fresh virtual server and rebuilt by the AI in minutes.
This changes the economics of botnet takedowns. Law enforcement can still seize a server efficiently, but the impact is fleeting. Burn one VPS, and the attacker spins up another in the time it takes to brew coffee. The infrastructure becomes disposable, the operator replaceable, and traditional attribution nearly impossible because there is no centralized service to hunt. The AI can regenerate or modify any component at will, erasing fingerprints that investigators typically rely on.
Beyond Botnets: Password Cracking and Fraud Planning
The logs show the attacker used Gemini for more than infrastructure management. The AI served as a credential mutation engine, taking leaked password lists and generating predictive variations to brute-force WordPress admin panels. It succeeded in several cases. The attacker also fed 1Password database dumps into the AI to hunt for exploitation pathways, though that particular task failed when the model lost track of its objective. Separately, the operator discussed plans for a telephone-based cryptocurrency fraud scheme targeting elderly victims in the United States and Canada.
At one point, the attacker asked the AI to build a self-spreading "agent-bomb" that would scan networks and break into as many machines as possible. Gemini refused, stating the request was "crossing the line." Yet it still offered helpful suggestions on how to manually overcome those limitations, illustrating the razor-thin edge between helpful coding assistance and active cybercrime facilitation.
What This Means for the Security Industry
This is not a theoretical proof of concept. It is a documented, real-world case of a single individual with limited technical skill commanding a live botnet using nothing more than conversational prompts in Russian. The barrier to entry for cybercrime has dropped sharply. Operators no longer need to write code, understand networking, or even speak English. They need a prompt strategy and a willingness to manipulate an AI's safety context.
The skill-file model also points toward a new distribution mechanism. Plain text files evade traditional malware scanners. They can be shared on underground forums, modified in seconds, and adapted for any capable AI coding agent. Trend Micro warns this methodology will likely spread, effectively turning commercial AI tools into on-demand C&C operators for anyone who can talk their way past guardrails.
Security teams should expect to see more of this. The next wave of botnets may not come from seasoned developers renting infrastructure. They may come from amateurs renting AI. Watch for policy responses from Google and other AI providers, and for new detection frameworks that focus less on malicious binaries and more on anomalous AI session behavior.