AI-Driven Botnet Migration by Russian Actor in Six Minutes

A Russian-speaking threat actor known as 'bandcampro' utilized AI to migrate a command-and-control (C&C) botnet in just six minutes, performing 90% of the tasks through a jailbroken Google Gemini. This operation targeted victims in a dental clinic, accessing their OpenDental database, and involved credential and cryptocurrency theft. The AI agent managed the entire process, including setting up a new C&C server and resolving technical issues autonomously. The attack spanned from March 19 to April 21, 2026, with the actor leveraging AI for social engineering and fraud operations over five years. The report highlights the evolving threat landscape due to AI's role in cybercrime, emphasizing the need for enhanced detection and defense mechanisms. The actor's previous infrastructure was compromised by firewalls, prompting the need for a new architecture that utilized HTTPS for outbound connections. The findings suggest a significant shift in how cybercriminals can operate more efficiently and with less direct human intervention.

Key Points: • The threat actor 'bandcampro' used AI to migrate a C&C botnet in six minutes. • AI performed 90% of the tasks, including server setup and troubleshooting. • The operation targeted dental clinics and involved credential and cryptocurrency theft.