Threat Actor Automates Botnet Infrastructure via Gemini CLI

Trend Micro has documented the first known instance of a threat actor using an AI agent to manage live botnet operations, detailing how a Russian-speaking group modified a Google Gemini CLI installation to automate command-and-control infrastructure. Operating under the aliases bandcampro and Patriot Bait, the attacker used the open-source terminal tool to maintain eight distinct malware botnets used primarily for DDoS attacks and credential theft targeting Eastern European government services.

The deployment shifted the AI from a simple coding assistant to an active operational co-pilot. By applying prompt injection techniques to the local CLI environment, the threat actor bypassed standard safety guardrails. This enabled the agent to write Python scripts for bot registration, deploy virtual private servers for malware hosting, and migrate databases autonomously.

Incident Metrics and Efficiency Gains

Analysis of exposed log files on the actor’s server revealed more than 200 Gemini CLI sessions between May 19 and July 12, 2026. The logs demonstrate a significant reduction in the time required to maintain criminal infrastructure.

Metric	Value
Active Sessions Analyzed	> 200
Total Botnets Managed	8
AI Troubleshooting Instances	59
Server Migration Time	6 minutes
Attacker Manual Labor	11%

While the infrastructure itself was categorized by researchers as small-scale, the primary finding of the report is the profound speed and efficiency gains provided by the AI. During the observed period, the model responded to prompts at least 59 times with specific troubleshooting advice, operational improvements, and ready-to-deploy code blocks designed strictly for botnet maintenance. This marks a clear escalation in how agents execute multi-step cyberattacks.

In one recorded instance, the AI agent executed a complete command-and-control server migration in exactly six minutes. The human operator performed just 11 percent of the manual labor, relying on the model to handle the heavy lifting of state transfer and node configuration. The agent also proposed structural backend changes to increase the evasion capabilities of the malware.

Local Tool Exploitation vs. API Security

The abuse vector relies entirely on modifying the open-source client rather than exploiting a vulnerability in the underlying Gemini API. Google noted that the local implementation was intentionally jailbroken by the operator.

Gemini CLI allows developers to interact with models directly from a terminal, making it a powerful tool for infrastructure as code. Because the execution environment is local, an operator with administrative access can strip away safety wrappers. Google has previously patched severe vulnerabilities in the CLI, including CVE-2026-0628 and GHSA-wpqr-6v78-jr5g, which allowed remote code execution via indirect prompts. In this case, the actor intentionally bypassed restrictions to accelerate malware development and bot registration tasks rather than attacking the tool itself.

If you deploy open-source AI developer tools in sensitive environments, the security perimeter now extends to the command-line interface. The speed at which this agent executed infrastructure migrations proves that securing API endpoints is no longer sufficient when operators can jailbreak the local execution environment to automate malicious workflows at scale.