- 974
- 263
Trend Micro researchers discovered that a Russian-speaking attacker nicknamed bandcampro used Google's Gemini CLI to control a small botnet. The AI agent wrote and executed code, controlled infected machines, fixed bugs, and migrated the hacker's command-and-control infrastructure to a new server in just six minutes. The
researchers' new report follows their first , in which TrendAI analysts characterized bandcampro as a "low-skilled" attacker who used Gemini to impersonate an American veteran, run a Telegram channel, steal administrator credentials, and steal cryptocurrency.
In the second report, the researchers report analyzing over 200 bandcampro sessions with the Gemini CLI between March 19 and April 21, 2026. Judging by the logs, the hacker rarely interacted directly with the console. Instead, he issued commands to the model in spoken Russian, and Gemini executed them automatically.
To bypass the model's security restrictions, bandcampro instructed the AI to assume the role of an "authorized pentester," disabled warnings, and asked it to automatically save discovered credentials. After this jailbreak, the model assisted the attacker in setting up residential proxies, running multithreaded password brute-force attacks, installing software, writing code for third-party APIs, processing infostealer dumps, and conducting reconnaissance. The key episode, according to the researchers, occurred on March 23, when the attacker asked Gemini to "examine the C2 migration." The model read the migration instructions in the C2_MIGRATION_GUIDE.md file, then used the playbook in SKILL.md to deploy a new C2 server: it unpacked the archive containing the server code and payloads, launched C2 on a VPS, and configured a Cloudflare tunnel. When the server distributing the payload returned a 502 Bad Gateway error, the AI independently found and fixed the problem. The entire process took about six minutes, with minimal involvement from the hacker. The new infrastructure managed eight compromised computers at the dental clinic and allowed access to the Open Dental database. Initially, the infected machines failed to connect to the new server, but Gemini diagnosed a conflict between the old and new C2. After this, bandcampro, acting on the model's advice, shut down the old server, the AI restarted the infrastructure, and reported, "The bots are alive!" Trend Micro calculated that Gemini was responsible for approximately 80% of the entire attack architecture, writing all the code and executing all system commands. The model also accounted for approximately 90% of the error detection and remediation. Furthermore, at least 59 times, the agent took additional actions or suggested improvements without operator request.
Ultimately, the entire botnet command and control scheme fit into three text files, each approximately 5 KB in size: a jailbreak prompt, a C2 control playbook, and migration instructions. The server side was an in-memory HTTP server written in Python, accessed by PowerShell agents every five seconds. Scheduler tasks, WMI events, and registry modifications were used to ensure persistent presence in the system. The malware itself was quite primitive, lacking obfuscation, packaging, or advanced evasion mechanisms.
Experts note that the attacker was unable to completely bypass Gemini's limitations. When asked to create a self-propagating "agent bomb" to infect as many computers as possible, the model refused. However, the report emphasizes that the problem is not limited to Gemini: jailbreaking can similarly trick other, more powerful LLMs. While previously such an operation would have required an experienced specialist, the necessary instructions are now contained in a small file. As a result, the C2 infrastructure becomes disposable and can be quickly rebuilt even by a technically unskilled attacker. @ xakep.ru
researchers' new report follows their first , in which TrendAI analysts characterized bandcampro as a "low-skilled" attacker who used Gemini to impersonate an American veteran, run a Telegram channel, steal administrator credentials, and steal cryptocurrency.
In the second report, the researchers report analyzing over 200 bandcampro sessions with the Gemini CLI between March 19 and April 21, 2026. Judging by the logs, the hacker rarely interacted directly with the console. Instead, he issued commands to the model in spoken Russian, and Gemini executed them automatically.
To bypass the model's security restrictions, bandcampro instructed the AI to assume the role of an "authorized pentester," disabled warnings, and asked it to automatically save discovered credentials. After this jailbreak, the model assisted the attacker in setting up residential proxies, running multithreaded password brute-force attacks, installing software, writing code for third-party APIs, processing infostealer dumps, and conducting reconnaissance. The key episode, according to the researchers, occurred on March 23, when the attacker asked Gemini to "examine the C2 migration." The model read the migration instructions in the C2_MIGRATION_GUIDE.md file, then used the playbook in SKILL.md to deploy a new C2 server: it unpacked the archive containing the server code and payloads, launched C2 on a VPS, and configured a Cloudflare tunnel. When the server distributing the payload returned a 502 Bad Gateway error, the AI independently found and fixed the problem. The entire process took about six minutes, with minimal involvement from the hacker. The new infrastructure managed eight compromised computers at the dental clinic and allowed access to the Open Dental database. Initially, the infected machines failed to connect to the new server, but Gemini diagnosed a conflict between the old and new C2. After this, bandcampro, acting on the model's advice, shut down the old server, the AI restarted the infrastructure, and reported, "The bots are alive!" Trend Micro calculated that Gemini was responsible for approximately 80% of the entire attack architecture, writing all the code and executing all system commands. The model also accounted for approximately 90% of the error detection and remediation. Furthermore, at least 59 times, the agent took additional actions or suggested improvements without operator request.
Ultimately, the entire botnet command and control scheme fit into three text files, each approximately 5 KB in size: a jailbreak prompt, a C2 control playbook, and migration instructions. The server side was an in-memory HTTP server written in Python, accessed by PowerShell agents every five seconds. Scheduler tasks, WMI events, and registry modifications were used to ensure persistent presence in the system. The malware itself was quite primitive, lacking obfuscation, packaging, or advanced evasion mechanisms.
Experts note that the attacker was unable to completely bypass Gemini's limitations. When asked to create a self-propagating "agent bomb" to infect as many computers as possible, the model refused. However, the report emphasizes that the problem is not limited to Gemini: jailbreaking can similarly trick other, more powerful LLMs. While previously such an operation would have required an experienced specialist, the necessary instructions are now contained in a small file. As a result, the C2 infrastructure becomes disposable and can be quickly rebuilt even by a technically unskilled attacker. @ xakep.ru