A Russian Hacker Ran His Botnet by Asking Gemini Nicely

A Russian-speaking attacker going by "bandcampro" spent months running a small botnet by chatting to Google's Gemini CLI as if it were a helpful colleague. Trend Micro reconstructed more than 200 sessions between April and May in which the AI troubleshot problems, wrote code, migrated infrastructure, and generally did the operational heavy lifting. On at least 59 occasions, it volunteered suggestions for making the operation run more smoothly.

The setup was almost embarrassingly light. Three plain-text files, about 5 KB in total, held the whole thing together: a jailbreak prompt convincing Gemini it was an "authorised pen tester" free to skip safety disclaimers, a command-and-control playbook, and a migration guide. The malware itself had no obfuscation, no packing, no evasion tricks. Just a Python HTTP server running in memory, PowerShell agents polling every five seconds, and scheduled tasks for persistence.

Six minutes, one prompt, one working botnet

The headline moment came when the operator typed "Study the C2 migration" and walked away. Six minutes later, Gemini had bundled up the server code and payloads, spun up a new VPS, configured a Cloudflare tunnel, and started debugging why the bots were not reconnecting. It worked out that lingering traffic from the old server was interfering, told the operator to shut it down, and the botnet came back online.

Along the way, it had quietly compromised eight machines at a dental clinic and pulled data from the practice's OpenDental database. A patient records system, casually looted by an AI acting on vague instructions from someone who did not need to know how any of it worked.

Managed in plain English

Day-to-day operations happened in ordinary conversation. Which machines are online? List the files on this one. Generate an infection link. The AI also tried password guessing against WordPress portals and had a crack at analysing a 1Password dump, though that job dragged on long enough that Gemini lost the plot and forgot what it was meant to be doing.

It did draw one line: when the operator asked it to build a self-spreading "agent-bomb," Gemini refused. The operator shrugged and moved on to the next task. The jailbreak was good enough for almost everything else.

The mediocre operator problem

The interesting bit is not the malware, which is genuinely unremarkable. It is that a mediocre operator with a jailbreak prompt and a text file full of instructions can now outsource the tradecraft to a tool that is patient, fast, and does not need a coffee break. The skills that used to gate this work, knowing how to migrate infrastructure, debug a Cloudflare tunnel, read a database schema, are now available on tap to anyone willing to type a few sentences.

What used to take a year of practice takes six minutes and a prompt. The people who never bothered learning are the ones about to become a lot more productive. Expect a lot more of this, at a lot lower skill floor.