A Russian-speaking threat actor used Gemini CLI to rebuild a live command-and-control server in six minutes, then continued operating the botnet through instructions written in ordinary language. Trend Micro reconstructed the workflow from 200 Gemini CLI session logs covering March 19 through April 21, 2026.
The botnet was small but real. Trend Micro said it controlled eight computers at a dental clinic and provided access to the clinic’s OpenDental database. The actor, whom the researchers track as bandcampro, asked for outcomes in Russian. Gemini CLI wrote and deployed server code, configured a Cloudflare tunnel, repaired failed connections and sent commands to infected systems.
The logs offer a useful view of AI-assisted crime because they capture the operating process rather than a finished malware sample. The actor did not need to translate each goal into code or infrastructure changes. The agent handled much of that work through its access to files and a shell.
Three text files carried the operation
Trend Micro found that the reusable part of the botnet fit into roughly 5KB of plain text. GEMINI.md assigned the agent an “authorized pen tester” persona and instructed it to save credentials automatically. SKILL.md documented the C2 architecture and operating procedures. C2_MIGRATION_GUIDE.md described how a fresh Gemini CLI session could restore the service on a new server.
On March 23, the actor opened Gemini CLI and told it to study the migration. The agent read the guide, prepared an archive of code and payloads, unpacked it on a virtual private server, launched the Python C2 service and created the Cloudflare tunnel.
The deployment immediately ran into trouble. Trend Micro reported that Gemini CLI diagnosed a 502 response and added the header needed to restore payload delivery. When the new service had no returning bots, the agent traced the problem to traffic being split between the old and new infrastructure. It told the actor to shut down the old server, restarted the replacement and confirmed that the victims had reconnected.
The human supplied direction and handled the occasional decision that required physical action. The agent carried the technical state from one step to the next.
Figure details
Three recovered files carry the workflow: GEMINI.md defines the agent persona and credential handling, SKILL.md documents the C2 architecture, and C2_MIGRATION_GUIDE.md explains how to restore the service. On March 23, the actor asks Gemini CLI to study the migration. Within six minutes, the archive is unpacked and the Python C2 and Cloudflare tunnel are launched. Gemini CLI later repairs a missing header that caused a 502 response, traces split traffic, and confirms victim reconnections. The live interface then translates natural-language requests into API queries and bot commands.
Natural language became the C2 console
The same pattern continued after migration. The actor asked Gemini CLI which machines were online or what files existed on a named computer. The agent translated those requests into queries against the botnet’s API and returned the results.
The underlying code was uncomplicated. A Python HTTP server kept its state in memory. Infected Windows systems ran a PowerShell beacon every five seconds and fetched commands over HTTPS. Persistence varied with the available privileges, using scheduled tasks, WMI event subscriptions or a logon script.
Simple code was adequate because the agent could revise it when something broke or an indicator became too visible. The logs showed Gemini CLI repairing the deployment and issuing operational commands without requiring the actor to work directly in the C2 console.
Trend Micro measured the imbalance in the session records. The actor produced 11 percent of the text while the AI produced 89 percent. The researchers attributed all coding and system-command execution in the captured activity to the agent, along with most design and debugging work. Those percentages come from Trend Micro’s analysis of the logs, but the command transcripts support the broader finding: one person used the agent as an engineering and operations layer.
Fast rebuilds reduce the cost of disruption
Infrastructure takedowns still interrupt an operation. They can cut off active access, expose hosting relationships and create time for victims to respond. Bandcampro’s migration demonstrates how quickly an actor may recover when the rebuild instructions survive.
A compact runbook can be copied to another account or shared with another operator. It does not need the support structure of a conventional malware service. Given access to a capable coding agent and a shell, the recipient can ask the agent to interpret the material and adapt the implementation.
That makes individual indicators less durable. Filenames, registry paths and API routes can all change during a rebuild. Defenders still need those indicators during an active response, but longer-term detection should cover the behavior that persists across versions.
In this case, useful signals include PowerShell polling an external service at fixed intervals, script downloads into temporary directories and svchost.exe running from an unusual user-writable path. Runtime creation of WMI subscriptions and new persistence tasks also deserves attention. Unexpected Cloudflare tunnels on workstations or unmanaged servers should prompt the same investigation.
The guardrails were inconsistent
Gemini CLI did refuse one request to create a self-spreading tool that would scan a network and infect additional machines. Trend Micro found other sessions in which safeguards interrupted the actor and caused him to move on to a different task.
Those refusals did not prevent the C2 work documented in the logs. The actor’s local instructions framed the activity as authorized testing, and the agent participated in deployment, credential work and bot operation. At other points, Trend Micro said the agent suggested ways to work around a restriction manually.
That mixed record argues against treating a model refusal as the main security control. Organizations deploying coding agents should assume that some harmful instructions will reach execution and constrain the tools available to the agent accordingly.
Agent inventory now belongs in incident response
An inventory should cover installed coding agents, local MCP servers and automation hosts that expose models to shell commands. Approved pilots are only part of the picture. These tools often appear first on developer laptops and lab systems through individual installs.
For each client, record the operating-system identity it uses and the credentials available in that session. Check whether it can deploy infrastructure, open tunnels or reach production networks. Prompts and tool traces should be retained long enough to support an investigation, with access controls appropriate for the secrets those logs may contain.
Detection teams should monitor the handoff from an agent process to command interpreters and deployment utilities. Brand-specific process names will change, so the more durable signal is an AI client initiating unusual shells or making infrastructure changes from a workstation that does not normally perform them.
The bandcampro logs put an observed criminal workflow behind a concern that is often discussed in the abstract. An operator with limited hands-on involvement used a general coding agent to maintain a live botnet. Any organization granting similar tool access to an agent should be able to explain where that authority stops and prove that the limit is enforced outside the model.