Russian Hackers Exploit Google Gemini CLI to Compromise 8 Computers in Dental Clinic Botnet

Russian Hackers Exploit Google Gemini CLI to Compromise 8 Computers in Dental Clinic Botnet

2026-07-20 09:38View Original

According to reports, Trend Micro analyzed 200 Gemini CLI session logs from March 19 to April 21, 2026, revealing that a Russian-speaking threat actor known as "bandcampro" abused Google's open-source Gemini CLI to conduct cyber operations and control a small botnet. The actor leveraged AI to crack passwords, set up residential proxies, compromise WordPress merchants, and plan phone-based cryptocurrency scams targeting elderly individuals in the United States and Canada. Logs indicate the actor also used AI to migrate C&C servers, gain control over eight computers at a dental clinic, and access the OpenDental database. The entire C&C operation was orchestrated through approximately 3 plaintext files totaling around 5KB. The AI proactively offered 59 improvement suggestions without being prompted and completed the migration to a new architecture along with error remediation within six minutes.

Disclaimer: Contains third-party opinions, does not constitute financial advice

Recommended Reading

Claude Fable and Internal Codex Continuously Uncover Three-Dimensional Counterexamples to the Jacobian Conjecture

9 mins ago
Claude Fable and Internal Codex Continuously Uncover Three-Dimensional Counterexamples to the Jacobian Conjecture

Anthropic Secures $1.5 Billion Copyright Settlement, Bringing Closure to Claude's Book Training Controversy

5 hours ago
Anthropic Secures $1.5 Billion Copyright Settlement, Bringing Closure to Claude's Book Training Controversy

Tencent Hunyuan Unveils Research Intelligence Agent Hyra-1.0: Achieves 29 Records by Solving 55 Open Mathematical Problems

5 hours ago
Tencent Hunyuan Unveils Research Intelligence Agent Hyra-1.0: Achieves 29 Records by Solving 55 Open Mathematical Problems

Rumors circulate that DeepSeek has offered a pre-tax salary of 5,500 RMB per day to a Tsinghua Yao Class intern, though the compensation details have not been officially confirmed.

1 day ago
Rumors circulate that DeepSeek has offered a pre-tax salary of 5,500 RMB per day to a Tsinghua Yao Class intern, though the compensation details have not been officially confirmed.

Jefferies says AMD's July 22 Advancing AI event may unveil progress on customer collaborations, among other developments

3 days ago
Jefferies says AMD's July 22 Advancing AI event may unveil progress on customer collaborations, among other developments

MiniMax showcases M3, H3, and other multimodal models along with AI-native products at WAIC 2026

3 days ago
MiniMax showcases M3, H3, and other multimodal models along with AI-native products at WAIC 2026

Moonshot's new member Yang Xinyu explains the rationale behind Kimi's launch of K3: the team remains committed to pursuing AGI and has introduced the "Five Precepts of Kimi."

3 days ago
Moonshot's new member Yang Xinyu explains the rationale behind Kimi's launch of K3: the team remains committed to pursuing AGI and has introduced the "Five Precepts of Kimi."