Between March 19 and April 21, 2026, a Russian-speaking threat actor known as "bandcampro" weaponized the open-source Google Gemini CLI to implement "agentic malware." Rather than utilizing the LLM for simple code generation, the actor delegated active operational control to the CLI, transforming the AI into an autonomous hacking agent. The actor used this capability to automate the management of a small-scale botnet, orchestrate password-cracking campaigns, and configure residential proxy infrastructure for network obfuscation. Analysis of approximately 200 session logs confirms a significant shift toward operational outsourcing, where AI manages C2 functions and infrastructure deployment with minimal manual intervention.

• Incident Overview: The Rise of Agentic Malware

  • Transitioned from using AI as a coding assistant to using it as a functional operational agent.
  • Enabled a solo attacker to scale complex infrastructure tasks without increasing manual effort.
  • Established a precedent for "agentic" behavior where the LLM executes and manages live attack phases.

• Attack Vector: Google Gemini CLI Weaponization

  • Abused the open-source Google Gemini CLI to bridge the gap between LLM reasoning and system execution.
  • Leveraged the CLI to issue and manage commands for infrastructure setup and maintenance.
  • Used the AI to automate the deployment of residential proxies to mask the actor's true origin.

• Operational Impact: Automated Botnet Orchestration

  • Managed a small-scale botnet through AI-driven delegation and command issuance.
  • Automated the execution and monitoring of password-cracking efforts.
  • Reduced the operational friction typically associated with maintaining Command and Control (C2) stability.

• Forensic Analysis: Evidence and Indicators

  • Analyzed approximately 200 session logs detailing the actor's specific prompts and the AI's subsequent actions.
  • Identified patterns of operational delegation, where the actor provided high-level goals and the AI executed the technical steps.
  • Documented the use of residential proxy layers configured specifically by the agentic tool.

• Conclusion: Strategic Defense Implications

  • Represents a critical escalation in AI threat models, moving from "AI-assisted" to "AI-operated" attacks.
  • Highlights the risk of open-source AI interfaces being repurposed as flexible, intelligent C2 frameworks.
  • Necessitates updated monitoring for unusual CLI activity and API traffic associated with LLM interfaces.