[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8rq1P2mVNKe_IKKj_SU_vnhCiTce-wwFrA8YV0MsdII":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"032c14e0-c77b-4c74-8460-d157f0ebafcf","Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs","russian-speaking-hacker-uses-google-gemini-cli-to-control-botnet-of-eight-dental-3fb4b3","A solo Russian-speaking threat actor known as \"bandcampro\" outsourced a chunk of their operations to Google's open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet. The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, which found the threat actor using AI, among other things, to crack passwords, set up a residential","A Russian-speaking threat actor known as 'bandcampro' abused Google's open-source Gemini CLI to operate a botnet commanding eight computers in a dental clinic, manage C&C infrastructure, and conduct cryptocurrency fraud targeting elderly people in North America. Analysis of 200 Gemini CLI session logs (March–April 2026) revealed the actor using AI as a primary hacking agent for password cracking, proxy setup, WordPress compromise, and C&C migration completed in minutes. The highly replicable, lightweight C&C operation (5 KB across three files) demonstrates how AI tools can significantly amplify the capabilities and speed of solo threat actors.","Russian hacker 'bandcampro' uses Google Gemini CLI to control dental clinic botnet and conduct fraud schemes.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Frussian-speaking-hacker-uses-google.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgyO5FC_n2BBZmiHphtqs0UN5r3DPgtRvkrVfaHOW-1Fv2VPXZliRYDryKR5I-vdZxtmChQJB6eAlJsND-e47t5lLQQ4SWkSJ_D02SEL6nRBmnJ-klfjSSg7rjRyf5AfzX340_se2vNrobCydtV-NZPsDm8MvL9UG0atiMekaxCNzHwizxZFlRhvpuM8BjE\u002Fs1600\u002Fgemini-cc.jpg","2026-07-20T09:07:11+00:00","2026-07-20T10:00:16.48969+00:00",9,[17,20,23,26,28,31],{"name":18,"type":19},"bandcampro","threat_actor",{"name":21,"type":22},"Google","vendor",{"name":24,"type":25},"Google Gemini CLI","product",{"name":27,"type":25},"OpenDental",{"name":29,"type":30},"Cloudflare Tunnels","technology",{"name":32,"type":22},"Trend Micro","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53],{"type":37,"value":51,"context":52},"bandcampro C&C botnet","Lightweight C&C infrastructure (5 KB) controlling dental clinic machines via Cloudflare tunnels",{"type":37,"value":54,"context":55},"PowerShell command payload","Staged on C&C server and executed on victim machines via HTTPS requests",[21,32,24],{"controls":58,"vendors":135},[59,80,106],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[64,72],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[85,93,98],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":94,"product_name":95,"url":96,"description":97},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":107,"name":108,"problem":109,"products":110},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":156},"ai-powered-botnet-operated-from-dental-clinic-pcs-highlights-smb-blind-spots","AI-Powered Botnet Operated from Dental Clinic PCs Highlights SMB Blind Spots","A lone Russian-speaking threat actor leveraged Google's open-source Gemini CLI as an AI hacking agent to commandeer eight computers inside a dental clinic, using them as C&C infrastructure for cryptocurrency fraud targeting elderly victims. The attack succeeded because small healthcare practices routinely lack endpoint visibility, network segmentation, and the security expertise to detect a lightweight 5 KB botnet living quietly on staff workstations. What makes this case particularly alarming is the AI multiplier effect: tasks that once required a skilled team — password cracking, proxy chaining, WordPress exploitation, C&C migration — were completed by a single actor in minutes. This signals a fundamental shift in the threat landscape where AI tools dramatically lower the skill floor for sophisticated, multi-stage attacks. Organizations of any size must now assume that even modestly resourced adversaries can operate with speed and capability previously reserved for nation-state actors.",[141,142,143,144,145,146,147,148,149,150,151,152,153,154,155],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 13 – Network Monitoring and Defense","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 SI-4 – Information System Monitoring","NIST SP 800-53 CM-7 – Least Functionality","NIST CSF DE.CM-1 – Network Monitoring","HIPAA Security Rule §164.312(a)(1) – Access Control","HIPAA Security Rule §164.312(b) – Audit Controls","MITRE ATT&CK T1059 – Command and Scripting Interpreter","MITRE ATT&CK T1543 – Create or Modify System Process","MITRE ATT&CK T1102 – Web Service (C&C via legitimate services)",{}]