A Russian-speaking threat actor operating under the handle "bandcampro" leveraged Google's open-source Gemini CLI tool to manage a botnet compromising eight computers at dental clinic networks. Analysis of 200 Gemini CLI session logs spanning March 19 to April 21, 2026, revealed the attacker using the AI system for password cracking and botnet command execution.
The threat actor automated portions of their operation through Gemini CLI, reducing manual effort required to maintain persistence across the compromised dental practice infrastructure. Password cracking represents a particular concern, as dental clinics store sensitive patient records including names, dates of birth, insurance information, and medical histories. Compromised credentials enable lateral movement within networks and access to backup systems.
Botnet deployment on dental clinic systems creates multiple risks. The infected machines can participate in distributed denial-of-service attacks against third parties, sending malicious traffic from legitimate healthcare infrastructure. Attackers may also leverage the botnet for data exfiltration, credential harvesting, or deployment of secondary malware like ransomware or information-stealing trojans.
The use of Gemini CLI for offensive operations demonstrates how threat actors rapidly adopt legitimate developer tools for malicious purposes. Open-source AI assistants, designed to simplify coding and automation workflows, become force multipliers for individual attackers who lack advanced technical teams. This particular actor's reliance on a single AI tool and modest botnet size suggests a less sophisticated operation compared to organized cybercriminal groups, though the targeting of healthcare providers remains high-risk given regulatory obligations and sensitive data exposure.
Organizations operating dental practices or other healthcare facilities should implement endpoint detection and response solutions, segment networks to isolate patient data systems, enforce multi-factor authentication on administrative accounts, and monitor outbound connections for suspicious patterns. Regular patching of systems and staff security awareness training reduce initial compromise vectors that enable bot