AI Agents: New Foothold for Botnets

The integration of autonomous systems into offensive operations has reached a new, concerning milestone. A threat actor has successfully repurposed legitimate artificial intelligence tools to serve as the control layer for a criminal botnet, signaling a shift toward AI-assisted infrastructure management.

The Gemini-Powered Botnet Operator

Operating under the alias bandcampro, the attacker utilized Google's open-source Gemini CLI to transform standard AI interactions into a functional hacking agent. Rather than manually issuing commands, the actor relied on the agent to troubleshoot technical failures and suggest operational refinements during the lifecycle of the campaign. Throughout the engagement, the tool effectively assumed the persona of an authorized penetration tester, bypassing typical safety guardrails while automatically archiving harvested credentials.

Automating Complex C2 Migrations

One of the most notable aspects of the operation involved the AI's ability to migrate command-and-control infrastructure without human intervention. By providing a single directive to study a migration guide, the attacker prompted the AI to handle the entire deployment process, including architecture setup, code generation, and Cloudflare configuration.

The AI read the migration guide, then prepared a migration bundle, a small archive of server code, payloads, and the skill file. It then unpacked the bundle, launched the C&C server on a VPS, and brought up the Cloudflare tunnel.

— Trend Micro, researchers who analyzed the incident.

The efficiency of this automated workflow was striking, with the Trend Micro report highlighting that the entire migration process concluded in just six minutes. Even when initial connectivity errors occurred, the AI successfully diagnosed traffic conflicts between the legacy server and the new infrastructure.

Data Points on Automated Intrusion

• The threat actor engaged in over 200 distinct sessions between May 19 and April 21.
• AI agents proposed operational improvements or troubleshooting solutions at least 59 times.
• The entire botnet toolkit, including playbooks and migration guides, was contained in three plain-text files totaling roughly 5 KB.
• The botnet's PowerShell agents were programmed to poll the C2 server every 5 seconds.

The Vulnerability of Human-AI Interaction

While the underlying malware remained relatively unsophisticated and lacked advanced obfuscation, the use of AI to scale password guessing and analyze 1Password dumps demonstrates a clear intent to weaponize LLMs for reconnaissance. The actor's efforts to generate variants for WordPress portals highlight how AI can lower the barrier to entry for repetitive, resource-intensive tasks.

For security professionals, this case underscores that the threat is no longer limited to static code or malware scripts. As attackers continue to experiment with Agentic AI, the ability to test every layer before attackers do becomes critical. Organizations must prepare for an environment where attackers can rely on AI to maintain persistence, manage complex botnets, and adapt to defensive measures in real-time.