Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

A lone Russian-speaking threat actor leveraged Google's open-source Gemini CLI as an AI hacking agent to commandeer eight computers inside a dental clinic, using them as C&C infrastructure for cryptocurrency fraud targeting elderly victims. The attack succeeded because small healthcare practices routinely lack endpoint visibility, network segmentation, and the security expertise to detect a lightweight 5 KB botnet living quietly on staff workstations. What makes this case particularly alarming is the AI multiplier effect: tasks that once required a skilled team — password cracking, proxy chaining, WordPress exploitation, C&C migration — were completed by a single actor in minutes. This signals a fundamental shift in the threat landscape where AI tools dramatically lower the skill floor for sophisticated, multi-stage attacks. Organizations of any size must now assume that even modestly resourced adversaries can operate with speed and capability previously reserved for nation-state actors.