Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

A Russian-speaking hacker, known as bandcampro, has been found to be using Google's Gemini CLI artificial intelligence to control a botnet. The botnet consists of computers from eight dental clinic locations. An analysis of 200 Gemini CLI session logs revealed the hacker's use of AI for various tasks, including password cracking and setting up residential operations. The analysis was conducted on session logs from March 19 to April 21, 2026. The hacker appears to be a solo threat actor who has outsourced some of their operations to the Gemini CLI AI. The use of AI in this manner allows the hacker to efficiently manage their botnet and carry out malicious activities.