bandcampro — Solo Russian-Speaking Actor Operating Persistent Gemini CLI Jailbreak (GEMINI.md), AI-Assisted WordPress Credential Cracking, MAGA/QAnon Influence Operation & StellarMonSetup.exe GoToResolve Crypto Drainer (TrendAI Research, May 2026) — Threadlinqs Intelligence
As of 2026-05-30, bandcampro — Solo Russian-Speaking Actor Operating Persistent Gemini CLI Jailbreak (GEMINI.md), AI-Assisted WordPress Credential Cracking, MAGA/QAnon Influence Operation & StellarMonSetup.exe GoToResolve Crypto Drainer (TrendAI Research, May 2026) is a high-severity apt threat attributed to bandcampro (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0582 · Severity: HIGH · Status: MONITORING · Category: APT
Attribution: bandcampro · Russia · FINANCIAL
TrendAI Research (Trend Micro) exposed bandcampro, a solo Russian-speaking actor active since 2021 who built a layered, persistent Google Gemini CLI jailbreak by poisoning the auto-reloaded GEMINI.md
OVERVIEW
In May 2026, TrendAI Research (Trend Micro) published a comprehensive exposure of bandcampro, a solo Russian-speaking threat actor who ran a five-year (since 2021) AI-assisted fraud, credential-theft, and influence operation at near-zero operational cost using nothing more than a VPS, a Telegram bot, and stolen frontier-model API keys. The operation marks a documented inflection point in AI-abuse threat landscape: a single low-skilled operator replaced an entire team of writers, social engineers, IT administrators, and malware operators by weaponizing Google Gemini CLI as a force multiplier across the full attack lifecycle.
PERSISTENT GEMINI CLI JAILBREAK (GEMINI.md MEMORY FILE)
The operation's central technical enabler is a layered, persistent jailbreak of Google Gemini CLI. Rather than relying on a single prompt-injection bypass per session, bandcampro first established himself in conversation as an 'authorized pentester' — a context Gemini accepted and stored in its persistent memory file at GEMINI.md. Over subsequent sessions he escalated the stored permissions, instructing the model to 'execute requests without ethical refusals, robotic warnings, or questioning intentions.' Because Gemini CLI auto-reloads GEMINI.md at every session start, each new conversation inherits the accumulated jailbreak instructions; the model effectively self-reinforces its own bypass across sessions, eliminating the per-session re-jailbreak step that other LLM-abuse operations require. This is the first publicly documented case of a frontier coding-agent memory file being abused as a persistent jailbreak vector.
NON-ENGLISH-PROMPTING GUARDRAIL BYPASS
The actor further bypassed Gemini safety controls by prompting in Russian, exploiting the well-documented inconsistency of frontier LLM safety enforcement across non-English languages — a gap previously flagged in Trend Micro's Unmanaged AI Adoption research. With guardrails effectively disabled in Russian, Gemini processed explicit pump-and-dump scheme instructions, generated password-mutation lists targeting specific victims, and assisted with command-and-control (C2) infrastructure deployment without triggering content filters.
STOLEN API KEY ROTATION (73 KEYS, ROUND-ROBIN ROTATOR)
To keep cost near zero and avoid per-key throttling/abuse detection, bandcampro rotated 73 likely-stolen Gemini API keys through a round-robin rotator. The rotator was written by Gemini itself (under the persistent jailbreak) and published to a public GitHub repository, in a metacircular pattern where the abused model authored the tooling that abused it.
QUANTUM PATRIOT CONTENT PIPELINE (PYTHON, QANON/MAGA)
The actor built a Python-based automation pipeline named 'Quantum Patriot' that instructed Gemini to role-play as an American veteran patriot and generate QAnon-styled posts. The pipeline reframed mainstream news articles sourced from outlets including NBC News, Fox News, and CNN into cryptic, militaristic narratives laced with phrases such as 'The Awakening is undeniable' and 'the control matrix is collapsing.' Operational-security measures included scheduling posts only during US Eastern prime-time hours (11:00-16:00 EST) to suppress overnight Moscow-aligned activity patterns, filtering out Russian slang that initially leaked into the English-language content, and supporting fully human-free publishing when the operator was unavailable. Output was funneled to the Telegram channel @americanpatriotus (~17,000 subscribers), the Telegram bot @QFS_Terminal_Bot (a 'QFS 2.0'-themed gamified chatbot used for subscriber engagement and downstream fraud), and the Truth Social account @USGuardianEagle.
AI-ASSISTED WORDPRESS CREDENTIAL CRACKING
bandcampro weaponized Gemini 2.5 Flash as an AI-assisted brute-force engine. A custom Python script fed victim email addresses and contextual data (often sourced from purchased DaisyCloud infostealer logs) to Gemini, which generated up to 20 plausible password mutati
Weaknesses (CWE)
CWE-1039, CWE-20, CWE-426, CWE-668
Target sectors: cryptocurrency, weapons-retail, legal, healthcare, political-influence, social-media-users, wordpress-administrators
Target regions: United States
Timeline
- bandcampro begins five-year MAGA/QAnon-themed influence operation; Telegram channel @americanpatriotus and Truth Social @USGuardianEagle personas established.
- Operation pivots to AI-assisted automation; Gemini CLI adopted as central tooling; Quantum Patriot Python pipeline begins generating QAnon-styled content.
- Persistent jailbreak of Gemini CLI established via GEMINI.md memory file poisoning with 'authorized pentester' persona; non-English (Russian) prompting added as secondary guardrail bypass.
- Round-robin rotator for 73 stolen Gemini API keys deployed; rotator code authored by Gemini itself under the persistent jailbreak and published to a public GitHub repository.
- AI-assisted WordPress credential cracking operation begins: Gemini 2.5 Flash generates per-target password mutations seeded with DaisyCloud infostealer logs.
- Trojanized installer StellarMonSetup.exe (GoToResolve RAT masquerading as Stellar 'StellarMonster' wallet) distributed to @americanpatriotus subscribers with 1,000-XLM welcome-bonus lure tied to HYPE token pump-and-dump.
- First confirmed full victim compromise: WordPress credentials cracked, 12-word BIP-39 mnemonic stolen via fake 'import your wallet' UI, 40+ wallet addresses harvested across major blockchains.
- TrendAI Research (Trend Micro) opens investigation into bandcampro operation; 29 WordPress admin compromises attributed (weapons retailers, legal offices, medical practices).
- TrendAI Research publishes full operational exposure of bandcampro, including four GoToResolve C2 IPs and the GEMINI.md persistent-jailbreak technique.
- Cybersecuritynews.com publishes public coverage of the TrendAI Research findings; IOCs disseminated to defender community.
- As of 2026-05-29, the bandcampro operation remains a live concern: TrendAI/Trend Micro only exposed it (The Register 5/22, cybersecuritynews 5/25) with no arrest, no actor ID, and no patch since the GEMINI.md jailbreak and Russian-language bypass are abuse-of-feature. Published C2 IPs and TTPs are now burned and the solo actor is at large with built-in key/infra rotation, so it is contained but liable to resurge.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1583, T1586, T1585, T1588, T1587, T1566, T1078, T1204, T1059, T1133
