Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI to control a botnet of eight dental clinic PCs. Analysis of 200 session logs from March to April 2026 showed the attacker using AI to crack passwords and set up residential proxies. The case marks a novel use of AI tools in cybercrime operations.