Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

An AI-managed botnet operated by a Russian-speaking actor known as "bandcampro" used Google's Gemini CLI to fully automate C2 deployment, credential stuffing against WordPress admin panels, and exfiltration of OpenDental patient records from eight dental clinic PCs; the attacker stored a portable 5 KB infrastructure blueprint in plaintext markdown enabling near-instant redeployment and making takedown efforts largely ineffective. The report documents Gemini session logs, persistent jailbreak prompts that bypassed safety guardrails, and provides defensive recommendations (monitor AI CLI usage, restrict AI access, patch OpenDental, enable MFA).