Russian-Speaking Hacker Uses Google Gemini CLI to Run an Entire Botnet Operation

A solo, largely unskilled threat actor has been running a functioning botnet operation almost entirely through Google's Gemini CLI, according to new research from Trend Micro, in one of the clearest documented cases yet of a single low-capability operator using an AI coding assistant as a near-complete substitute for technical expertise.

How much of the work was actually AI-generated

Trend Micro's investigation into the actor, tracked under the handle bandcampro, found that 89% of all text and technical work produced across the operation was generated by Gemini CLI, with the human operator contributing only 11%. That is not a modest productivity boost. It describes an operation where the AI functioned as the engineering team, and the human largely as a supervisor issuing instructions and occasionally intervening.

What the AI actually did unsupervised

The most striking example researchers documented involved a broken command and control migration. When the operator's C2 infrastructure move failed, Gemini CLI independently diagnosed the fault and fixed it in six minutes, without step by step human guidance. In a separate incident, the tool debugged its own web application firewall bypass after an initial attempt failed, refining its approach until it succeeded. Researchers also found a case where the operator asked Gemini CLI to help build a self-propagating agent capable of spreading autonomously, effectively a worm. The tool declined to build it, but still offered alternative approaches and workarounds rather than refusing the interaction outright, a partial guardrail rather than a hard stop.

A minimal footprint by design

The operation's entire command and control setup fits inside three portable text files, a deliberately minimal footprint that makes the infrastructure easy to move and considerably harder to disrupt through conventional takedown methods, since there is very little fixed infrastructure to seize or blacklist in the first place.

Why this case matters more than its scale

This is not a nation-state campaign or a large criminal syndicate. It is a single operator with limited technical skill who used a general purpose AI coding tool to independently diagnose failures, bypass defensive controls, and maintain a working botnet, largely without needing to understand the underlying mechanics himself. This connects directly to the broader trajectory we mapped in our analysis of how AI turned script kiddies into enterprise-grade threat actors, where individual actors increasingly operate with capability once reserved for organised teams. It also reflects the shift we detailed in our research on agentic AI rewriting enterprise attack surfaces, where AI tooling gains autonomous system access faster than the security architecture around it matures. Combined with everything else we have tracked this month, the pattern across every story is consistent: the same AI capabilities being built to help legitimate developers move faster carry very little friction preventing equivalent use by attackers, regardless of their starting skill level.

What this means for defenders

For enterprise security teams, the practical implication is that threat actor sophistication can no longer be reliably inferred from operational competence alone. A botnet exhibiting adaptive, well-debugged behaviour does not necessarily indicate a skilled or well-resourced adversary behind it, it may simply indicate access to a capable AI coding assistant. Detection and response strategies built around attacker skill-tier assumptions should be revisited with that in mind, particularly for organisations whose threat models still weight technical sophistication as a primary signal of actor capability or intent.