cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Trend Micro: Threat Actor Used Gemini CLI to Operate Botnet Targeting Dental Clinic

· Original article ↗

Summary

Trend Micro says the actor bandcampro used Gemini CLI to operate a botnet controlling eight systems at a dental clinic, migrate its C2 infrastructure, and access the OpenDental database. The AI also assisted with troubleshooting and password guessing.

Key points

  • Trend Micro attributes the activity to a Russian-speaking actor known as bandcampro and says the operation involved more than 200 Gemini CLI sessions.
  • Researchers say the botnet controlled eight systems at a dental clinic and the actor accessed its OpenDental database.
  • Gemini CLI assisted with migrating C2 infrastructure, including server deployment and debugging; the migration took about six minutes.
  • The botnet’s operating instructions and components were stored in three plain-text files totaling about 5 KB.
  • The C2 used an in-memory Python HTTP server and PowerShell agents that polled every five seconds; persistence methods included scheduled tasks, WMI events, and registry modifications.
  • Trend Micro described the malware as unsophisticated, with no obfuscation, packing, or evasion mechanisms.
  • The actor allegedly used AI for password guessing and analyzing 1Password dumps; Gemini refused a request to build a self-spreading agent.

Article Details

Attack Vectors
  • The actor used natural-language prompts in Gemini CLI to operate and troubleshoot a botnet.
  • PowerShell agents polled an in-memory Python HTTP command-and-control server every five seconds.
  • Persistence relied on scheduled tasks, WMI events, and registry modifications, depending on privileges.
  • The actor allegedly used AI to guess password variants for WordPress portals and analyze 1Password dumps.

MITRE ATT&CK

T1053.005 · Scheduled TaskScheduled tasks were used for persistence, depending on privileges.T1059.001 · PowerShellPowerShell agents on botnet systems polled the command-and-control server.T1071.001 · Web ProtocolsThe botnet used HTTP for communications between its agents and the Python command-and-control server.T1083 · File and Directory DiscoveryThe actor asked the AI to list files on particular botnet computers.T1110.001 · Password GuessingThe actor allegedly used AI to generate plausible variants of existing passwords for guessing against WordPress portals.T1112 · Modify RegistryRegistry modifications were used for persistence, depending on privileges.T1546.003 · Windows Management Instrumentation Event SubscriptionThe article says persistence relied on WMI events, depending on privileges.

Threat Actors

bandcamproTrend Micro describes bandcampro as a Russian-speaking threat actor who used Gemini CLI to operate a botnet, migrate its C2 infrastructure, and access a dental clinic's OpenDental database.

Vendors

GoogleA Russian-speaking threat actor known as “bandcampro” abused Google’s Gemini CLI as a hacking agent to run and maintain a small botnet, migrate its C2 infrastructure, and access a dental clinic’s OpenDental database.

Products

1PasswordThe actor also used AI for password guessing and analyzing 1Password dumps.OpenDentalA Russian-speaking threat actor known as “bandcampro” abused Google’s Gemini CLI as a hacking agent to run and maintain a small botnet, migrate its C2 infrastructure, and access a dental clinic’s OpenDental database.WordPressBeyond the botnet, the actor allegedly used AI for password guessing, generating plausible variants of existing passwords for WordPress portals, and analyzing 1Password dumps to find exploitation alleys.

Tools

Gemini CLIA Russian-speaking threat actor known as “bandcampro” abused Google’s Gemini CLI as a hacking agent to run and maintain a small botnet, migrate its C2 infrastructure, and access a dental clinic’s OpenDental database.

Industries

DentalA Russian-speaking threat actor known as “bandcampro” abused Google’s Gemini CLI as a hacking agent to run and maintain a small botnet, migrate its C2 infrastructure, and access a dental clinic’s OpenDental database.

Related Articles