Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

A Trend Micro analysis of 200 Google Gemini CLI session logs found a Russian-speaking actor, "bandcampro", using an AI agent to deploy and operate disposable C2 infrastructure that controlled eight machines (including at a dental clinic), perform credential cracking and WordPress compromises, and plan phone-based cryptocurrency fraud under the "Patriot Bait" campaign; the AI handled most coding, debugging, and deployment tasks and the entire operation can be ported via three plaintext skill files, raising concerns about rapid reuse, reduced attribution, and wider spread of AI-assisted cybercrime.