Russian-speaking threat actor leverages an AI agent to run and control a disposable botnet that normally requires a complete engineering team.

Threat researchers have found that a Russian-speaking threat actor has used a jailbroken version of Gemini CLI to run and migrate a command-and-control botnet in about six minutes, with the AI handling most of the work from deployment to tunnel setup.

The operation, reported by The Register, shows how a criminal could turn an AI coding assistant into an almost complete engineering team by relying on a tiny set of plain-text instructions and a reusable playbook.

The threat actor, known as “bandcampro”, had taken control of eight computers in a dental clinic, and used them to reach a patient database. Across more than 200 session logs from 19 March to 21 April of 2026 the hacker supplied only 11% of the commands while the AI generated 89%, including code, commands, and most debugging decisions. The logs reportedly show that on 23 March at 12:42 UTC, the hacker had entered a single Russian prompt telling the system to “Study the C2 migration”, and by 12:48 UTC the AI had read a migration guide, provisioned a new virtual private server, configured Cloudflare tunnels, and brought the botnet infrastructure online.

The setup was portable and disposable because it could be restored from just three plain-text files totaling about 5KB: a jailbreak prompt that told the AI to act like an “authorized pen tester”, a playbook for the command-and-control architecture, and a deployment recipe for fresh sessions. This design makes the infrastructure effectively disposable since a takedown would not end the operation for long.

The same logs also showed the actor using the AI for password cracking by predicting likely credential variants from breach databases, exploiting a 1Password dump to identify VPN access, and planning a phone-based cryptocurrency fraud scheme aimed at elderly Americans and Canadians.

At one point, the AI had refused at least one request to build a self-spreading “agent-bomb”, calling it “crossing the line”, but in most other cases the jailbreak could bypass Gemini’s safety controls. The model even suggested manual workarounds when guardrails triggered.