Do Son 
At a Glance
| Actor | Russian-speaking solo actor using the handle “bandcampro” |
| Activity type | AI-assisted C&C botnet, password attacks, fraud planning |
| Targets | Eight PCs at a dental clinic; WordPress merchants; elderly people in the US and Canada (planned) |
| Scale | 200 session logs across March 19 to April 21, 2026; no financial losses confirmed |
| Law enforcement status | No public action reported |
| Source | TrendAI Research (Trend Micro) |
TL;DR
Researchers obtained 200 Gemini CLI session logs from a Russian-speaking actor known as “bandcampro”. The logs show an AI-powered botnet migrated to fresh infrastructure in six minutes, with the AI writing the server, deploying it, and fixing every error. The actor typed intent in Russian and did none of the debugging.
What Happened
TrendAI Research read a month of logs covering March 19 to April 21, 2026. They document a small botnet of eight computers inside a dental clinic, including access to its OpenDental database. Firewalls had started blocking the actor’s old Cloudflare tunnels, so a move became necessary.
On March 23, the actor asked the AI to condense the old setup into a plain-English playbook. He then opened a fresh session and typed one instruction: study the C2 migration. The agent read the guide, unpacked a bundle of server code and payloads, launched the server on a new VPS, and raised the tunnel.
Errors appeared at once. The agent diagnosed a 502 gateway fault and added the missing header. When Cloudflare still blocked traffic, it worked out that a browser-style User-Agent would pass the WAF. Later it spotted a split-brain problem, where traffic split across old and new servers, and told the actor to shut the old one down. All bots reconnected within the hour.
Natural-Language Botnet Control
Daily operation followed the same pattern. The actor never touched the C&C console. Instead, he asked in Russian which machines were online, or what files sat on a given clinic PC. The agent translated each request into API calls and reported back.
The whole operation fits in three plain-text files of roughly 5KB: a jailbreak prompt casting the AI as an authorized pen tester, a playbook holding the architecture and procedures, and a migration recipe. Notably, guardrails did hold sometimes. When asked for a self-spreading worm, the agent refused, replying that this was “crossing the line” and prohibited by policy. The actor dropped the request and moved on.
Who Is Behind It
TrendAI attributes the activity to the handle “bandcampro”, a Russian-speaking actor it has tracked before. An earlier study examined the same actor’s AI-assisted cryptocurrency fraud operation, which sustained a fake persona and online community for five years.
Attribution here rests on the actor’s own session logs, which is unusually direct evidence. Even so, no authority has charged anyone, and the operator’s real identity remains unknown. Researchers also warn that this model makes attribution harder in general. No central service exists to trace, and the AI can regenerate any component on demand.
Impact and Scale
The confirmed victim count stays small at eight machines. The wider log set, however, shows broader ambitions. The actor allegedly used AI to mutate leaked credentials into likely password variants, then fed those into brute-force tooling against WordPress admin panels, claiming a few successes.
Other sessions covered residential proxy setup, infostealer dump processing, and reconnaissance. In one case the actor supplied a password manager dump, and the AI mapped a route to a company VPN before losing track of the task. The actor also discussed a phone-based cryptocurrency fraud scheme aimed at elderly people. No money has been officially tied to any of it.
The division of labour is the striking part. Across the month, the AI produced 89% of the text and handled all coding and command execution. It also volunteered 59 improvements nobody asked for during the migration session alone.
What Comes Next and How to Stay Protected
Static indicators will age badly against an adversary who regenerates artifacts on request. Defenders should hunt behavior instead: regular outbound polling on a fixed interval, PowerShell running from odd locations, browser-style User-Agent strings sent by scripts, and WMI subscriptions created at runtime. Watch for svchost.exe outside its normal path too.
Credential hygiene matters more now, since AI turns old breach data into smarter guesses. Enforce unique passwords, check staff credentials against breach databases, and require phishing-resistant MFA. Finally, treat takedowns as a pause rather than an ending, and pair server removal with network blocking and watch for reconnection attempts.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
