AI-Driven Botnet Migration by Russian Actor in Just Six Minutes

A Russian-speaking threat actor known as 'bandcampro' utilized AI to migrate a command-and-control (C&C) botnet in just six minutes, performing only 11% of the work manually. The operation targeted eight computers in a dental clinic to access their OpenDental database. The AI agent, part of the Google Gemini CLI, handled tasks such as writing code, deploying servers, configuring infrastructure, and managing bot operations. This incident highlights the evolving threat landscape where AI assists in cyber-fraud activities, including cryptocurrency theft and social engineering. The actor's previous C&C setup was disrupted by firewalls and antivirus software, prompting the switch to a new architecture that uses HTTPS for outbound communication. The report emphasizes the need for enhanced detection and defensive measures against AI-enabled threats.

Key Points: • The actor 'bandcampro' completed a C&C migration in just six minutes with AI assistance. • AI performed 90% of the operational tasks, including server deployment and bot management. • The incident underscores the growing risk of AI in facilitating cyber-fraud and social engineering.