A Russian-speaking threat actor identified as “bandcampro” has demonstrated a sophisticated method of managing C2 infrastructure by integrating generative AI into their workflow. According to The Hacker News, the attacker outsourced a significant portion of their operational overhead to Google’s open-source Gemini CLI. Between March 19 and April 21, 2026, researchers analyzed 200 session logs that revealed the actor used the AI tool to facilitate password cracking and maintain a botnet comprising eight compromised workstations located in dental clinics.
Analysis of AI-Augmented Command and Control
The use of AI-driven botnet command and control represents a shift in how solo threat actors manage distributed infrastructure. By leveraging the Gemini CLI, bandcampro was able to process raw data from infected systems and generate actionable scripts for further exploitation. This interface served as an automated assistant, helping the attacker troubleshoot technical roadblocks and optimize their TTP execution. The primary focus of the campaign appears to have been the establishment of residential proxies, which allow attackers to route malicious traffic through legitimate consumer IP addresses to avoid detection by reputation-based security filters.
How to detect Google Gemini CLI exploit activities
For organizations operating in targeted sectors like healthcare, detecting unauthorized AI-related activity is now a priority. Defenders should monitor for the execution of the gemini-cli binary or similar AI-interface tools on workstations that do not have a documented business requirement for LLM development. Because the communication between the CLI and Google’s backend is encrypted, network-based detection relies on identifying anomalous egress traffic to Google Cloud API endpoints from administrative or clinical VLANs.
Identifying bandcampro threat actor TTPs also involves auditing process telemetry for instances where a shell (cmd.exe or powershell.exe) is spawned by a command-line tool associated with artificial intelligence. In many of the analyzed logs, the actor used the AI to refine commands for Privilege Escalation and credential harvesting. Security teams should implement EDR policies that flag the creation of proxy-related registry keys or the installation of unauthorized tunneling software on endpoints.
Impact on the Healthcare Sector
The targeting of dental clinics highlights a persistent risk to small-to-medium healthcare providers who may lack a dedicated SOC. These environments often run legacy software or lack comprehensive Zero Trust architectures, making them ideal targets for botnet recruitment. Once the systems were compromised, bandcampro utilized them to host residential proxies, effectively turning the clinics’ trusted network reputation into a tool for other cybercriminals. This not only risks patient data but also subjects the clinic to potential blacklisting and operational downtime.
Actionable Mitigations and Recommendations
To defend against this emerging class of AI-assisted threats, organizations should adopt the following measures:
- Software Restriction Policies: Block the execution of known AI command-line interfaces like Gemini CLI and other non-standard developer tools on production workstations.
- Egress Filtering: Restrict outbound traffic to cloud-based AI service endpoints to only authorized EDR or development systems.
- Credential Hygiene: Implement multi-factor authentication across all clinical systems to mitigate the effectiveness of the password cracking attempts observed in this campaign.
- Log Correlation: Configure the SIEM to alert on the simultaneous appearance of IoC patterns involving AI tools and proxy-related network configurations.