Threat Actor Used Gemini CLI to Build and Operate a Botnet in Minutes
Summary
Trend Micro analyzed more than 200 session logs showing a Russian-speaking actor using Gemini CLI to migrate and operate a botnet targeting eight dental-clinic computers, alongside credential attacks and fraud planning.
Key points
- The actor used Gemini CLI to migrate a live C2 server and restore bot connections in minutes, with the AI handling coding, deployment, configuration, and debugging.
- The botnet controlled eight computers at a dental clinic and accessed its OpenDental database; victims beaconed to the C2 over HTTPS and received PowerShell commands.
- The C2 operation was documented in three plain-text files totaling roughly 5 KB, making it easy to redeploy or adapt.
- The actor also used AI to generate password variants for WordPress brute-force attacks, process stolen credentials, and plan cryptocurrency fraud; some WordPress compromises succeeded.
- The malware used five-second polling, PowerShell payloads, and persistence through WMI subscriptions or scheduled tasks, depending on the actor's privileges.
- Trend Micro recommends behavior-based detection, including monitoring recurring outbound polling, PowerShell from unusual locations, and runtime-created WMI subscriptions.
- The article reports no definitive takedown or remediation status; it warns that rapid rebuilding could reduce the impact of server takedowns.
Article Details
- Attack Vectors
- The actor used Gemini CLI to deploy and operate a command-and-control server and botnet, with victims beaconing over HTTPS and polling for PowerShell commands.
- A PowerShell stager downloaded agent_final.ps1 from payloads.tralalarkefe[.]com.
- The botnet used recurring HTTP GET polling every five seconds, Base64-encoded tasking and telemetry, and custom HTTP headers identifying infected machines.
- Persistence was established through WMI event subscriptions and a startup scheduled task with administrator privileges, or a logon registry value and scheduled task without administrator privileges.
- The actor used AI-generated password variants in brute-force attempts against WordPress admin panels, with some reported successes.
- The actor processed stolen credentials and cookies to attempt access to a victim company's VPN and internal admin panel and to compromise an eCommerce site.
- Defensive Notes
- Prioritize behavioral detection over static indicators, including recurring outbound polling, PowerShell running from non-standard locations, and WMI subscriptions created at runtime.
- Enforce unique passwords, monitor employee credentials against breach databases, and require phishing-resistant multi-factor authentication.
- Pair server takedowns with network-level blocking and ongoing monitoring for reconnection attempts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | payloads[.]tralalarkefe[.]com | Payload-delivery domain used to download the botnet's PowerShell agent. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe actor attempted to use stolen credentials to access a company's VPN.T1053.005 · Scheduled TaskThe bot establishes persistence with scheduled tasks, including a startup task or a logon-triggered task.T1059.001 · PowerShellThe infected machines use PowerShell scripts to poll the C2 server and execute commands.T1071.001 · Web ProtocolsVictims communicate with the C2 server over HTTPS using HTTP polling and telemetry requests.T1105 · Ingress Tool TransferA PowerShell stager downloads agent_final.ps1 from the payload-delivery domain.T1110 · Brute ForceThe actor used AI-generated password variants in brute-force attempts against WordPress admin panels.T1546.003 · Windows Management Instrumentation Event SubscriptionWith administrator rights, persistence includes a WMI event subscription.T1547.001 · Registry Run Keys / Startup FolderWithout administrator rights, persistence includes setting HKCU:\Environment\UserInitMprLogonScript.
People
Threat Actors
Vendors
Products
1PasswordIn another case, the actor provided a 1Password dump, and the AI found which company the victim has access to, and found a way to use Duo and the company's VPN.CloudflareRussian, and the AI wrote the server, deployed it on a new VPS, configured the infrastructure, set up Cloudflare tunnels, managed the bots, debugged connectivity problems, and even suggested using an idle bot.DuoIn another case, the actor provided a 1Password dump, and the AI found which company the victim has access to, and found a way to use Duo and the company's VPN.Gemini CLITrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the workOpenDentalThe actor used Google Gemini CLI to deploy and operate a C&C infrastructure to control eight computers in a dental clinic and access their OpenDental database.WordPressBeyond the botnet, the actor used AI to crack passwords, compromise WordPress merchants, and plan a phone-based cryptocurrency fraud scheme targeting elderly people in the US and Canada.