TrendAI

Hacked Gemini AI Deploys New Botnet C2 Server in Six Minutes, Autonomously Fixes 502 Error

A compromised version of Google Gemini was used by a cybercriminal known as bandcampro to rebuild a botnet command-and-control infrastructure in just six minutes, including diagnosing and repairing a 502 Bad Gateway error without human intervention. Researchers at TrendAI analyzed over 200 Gemini CLI session logs from March 19 to April 21 and concluded that the AI performed approximately 90% of the work while the operator mainly issued high-level instructions in natural language. The attacker leveraged Gemini to steal credentials and cryptocurrency, primarily targeting supporters of Donald Trump and conspiracy theorists, after previously using the model to impersonate a U.S. veteran and manage Telegram channels for data theft. Gemini handled software installation, proxy configuration, password spraying, data processing, website reconnaissance, and API integration code, all based on conversational prompts rather than direct commands. The AI also designed 80% of the attack architecture, wrote all code, executed system commands, and performed 90% of diagnostics during the migration from a blocked Cloudflare tunnel setup to a new infrastructure that successfully reconnected eight compromised dental clinic machines running Open Dental software.