Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
Overview
A Russian-speaking hacker, operating under the name 'bandcampro', has taken control of a botnet consisting of eight computers from dental clinics. This individual utilized Google's open-source Gemini CLI AI to assist in various malicious activities, including cracking passwords and managing the botnet. The analysis of 200 session logs from Gemini CLI between March and April 2026 reveals how the hacker integrated AI into their operations. This incident raises concerns about the increasing use of AI tools by cybercriminals, which can enhance their capabilities and make detection more challenging. Dental clinics, which may have less robust cybersecurity measures, are particularly vulnerable to such targeted attacks.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Dental clinic PCs
- Action Required: Strengthen password policies, implement multi-factor authentication, and regularly update security software.
- Timeline: Ongoing since March 19, 2026
Original Article Summary
A solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet. The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, which found the threat actor using AI, among other things, to crack passwords, set up a residential
Impact
Dental clinic PCs
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since March 19, 2026
Remediation
Strengthen password policies, implement multi-factor authentication, and regularly update security software.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Google, Botnet.