As cited
Copy frozen at (site build).
threat intel
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
A Russian-speaking threat actor tracked as "bandcampro" leveraged Google's Gemini CLI to automate botnet operations, including password cracking and infrastructure setup, across eight compromised dental clinic computers. Analysis of 200 Gemini CLI session logs from March through April 2026 documented the actor's use of the open-source tool to streamline malicious activities.
Why it matters: Dental clinic operators and their IT teams need to detect and remediate this specific botnet compromise immediately; the incident illustrates how threat actors are repurposing widely available AI tools to scale attacks against small healthcare targets.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
A Russian-speaking threat actor known as bandcampro used Google's open-source Gemini CLI artificial intelligence (AI) tool to manage operations and control a botnet comprising eight dental clinic computers. Analysis of 200 Gemini CLI session logs from March 19 to April 21, 2026, revealed the actor leveraging AI for password cracking and other attack activities.
Why it matters: Dental clinics and healthcare organizations using or connected to systems with Gemini CLI access should audit logs and credential usage; this demonstrates how publicly available AI tools can be weaponized for botnet command and control at scale.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
A Russian-speaking threat actor known as bandcampro used Google's open-source Gemini CLI artificial intelligence (AI) tool to manage operations and control a botnet comprising eight dental clinic computers. Analysis of 200 Gemini CLI session logs from March 19 to April 21, 2026, revealed the actor leveraging AI for password cracking and other attack activities.
Why it matters: Dental clinics and healthcare organizations using or connected to systems with Gemini CLI access should audit logs and credential usage; this demonstrates how publicly available AI tools can be weaponized for botnet command and control at scale.
- Source published
- First seen by Cybersecurity Tracker