AI-Driven Botnet Migration by Russian Actor in Just Six Minutes

Theregister

AI-Driven Botnet Migration by Russian Actor in Just Six Minutes

First seen 14 Jul 2026, 14:06 UTC • •70.5

Article Content

1 / 22

Browse articles

ThreatCluster •July 15, 2026 at 11:13 UTC

•The actor 'bandcampro' completed a C&C migration in just six minutes with AI assistance.
•AI performed 90% of the operational tasks, including server deployment and bot management.
•The incident underscores the growing risk of AI in facilitating cyber-fraud and social engineering.

A Russian-speaking threat actor known as 'bandcampro' utilized AI to migrate a command-and-control (C&C) botnet in just six minutes, performing only 11% of the work manually. The operation targeted eight computers in a dental clinic to access their OpenDental database. The AI agent, part of the Google Gemini CLI, handled tasks such as writing code, deploying servers, configuring infrastructure, and managing bot operations. This incident highlights the evolving threat landscape where AI assists in cyber-fraud activities, including cryptocurrency theft and social engineering. The actor's previous C&C setup was disrupted by firewalls and antivirus software, prompting the switch to a new architecture that uses HTTPS for outbound communication. The report emphasizes the need for enhanced detection and defensive measures against AI-enabled threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 90d ago How this analysis works

Timeline

2026-03-19

AI-assisted operations began

The threat actor started using AI for daily hacking activities, documented in Gemini CLI logs.

2026-03-23

C&C migration plan initiated

The actor instructed the AI to summarize the old C&C setup and prepare for migration.

2026-04-21

C&C migration completed

The AI successfully migrated the C&C server and established a new architecture in six minutes.

2026-07-14

Incident reported

TrendAI published a report detailing the AI-assisted botnet operations of 'bandcampro'.

More articles in this cluster (21)

Threat Graph

11 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (1)

Bandcampro

Technique (6)

Botnet
Malware
T1059.001 - PowerShell
T1071 - Application Layer Protocol
T1110 - Brute Force
T1547 - Boot Or Logon Autostart Execution

Campaign (1)

Patriot Bait

Affected Platform (1)

WordPress

Tool (2)

Gemini CLI
PowerShell

Relationships

Bandcampro uses Gemini CLI
Bandcampro uses PowerShell
Bandcampro uses Botnet
Bandcampro uses Malware
Bandcampro uses T1059.001 - PowerShell
Bandcampro uses T1071 - Application Layer Protocol
Bandcampro uses T1110 - Brute Force
Patriot Bait attributed to Bandcampro
Bandcampro related to T1547 - Boot Or Logon Autostart Execution
Bandcampro related to WordPress

Following this threat?

Track Bandcampro in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…