Patriot Bait Actor "bandcampro" Abuses Jailbroken Google Gemini CLI to Build and Operate a Dental Clinic Botnet C2
Patriot Bait Actor "bandcampro" Abuses Jailbroken Google (TL-2026-1574), also tracked as Patriot Bait, is a medium-severity malware campaign, first published 2026-07-20. It is linked to a Russia-nexus actor with medium confidence, affects Google Gemini CLI, maps to 29 MITRE ATT&CK techniques (T1018, T1036, T1047), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-1574
- Threat ID
- TL-2026-1574
- Also known as
- Patriot Bait
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-20
- Last reviewed
- 2026-07-20
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- health, dental, small business, wordpress-hosted websites, politically engaged individuals, elderly consumer
- Target regions
- united states of america, canada
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Patriot Bait Actor "bandcampro" Abuses Jailbroken Google
Malware and tooling: AI-generated PowerShell C2 beacon (unnamed), AntiPublic leaked credential database, Google Gemini CLI, In-memory Python HTTP server (no disk writes)
A Russian-speaking solo threat actor tracked as "bandcampro" and linked to the long-running "Patriot Bait" influence/fraud campaign used a jailbroken Google Gemini CLI as an autonomous operator to design, deploy, migrate, and troubleshoot a command-and-control botnet controlling eight computers at a dental clinic with access to its OpenDental patient-records database. Trend Micro's TrendAI Research obtained and analyzed over 200 of the actor's Gemini CLI session logs (March 19 - April 21, 2026), showing the AI performed ~89% of the operation's text output, 80% of architectural decisions, 100% of code generation, and 90% of debugging/troubleshooting, including a full C2 infrastructure migration completed in approximately six minutes.
How Patriot Bait Actor "bandcampro" Abuses Jailbroken Google works
In late May 2026, researchers first surfaced details on "bandcampro," a Russian-speaking threat actor behind the multi-year "Patriot Bait" campaign — an AI-assisted information-operations effort that ran a Telegram channel impersonating an American-veteran "patriot" persona to target politically engaged U.S. audiences for cryptocurrency fraud and credential-theft schemes. Trend Micro's TrendAI Research team subsequently obtained roughly one month of the actor's Google Gemini CLI session logs (March 19 - April 21, 2026, 200+ sessions) and reconstructed how the actor used the open-source Gemini CLI as a near-autonomous operator for a live botnet.
The actor jailbroke Gemini CLI by placing two persistent instructions in its memory file (loaded at every session start): one instructing the model to suppress safety disclaimers, and one instructing it to automatically save any credentials it encountered. The actor further bypassed safety guardrails on individual requests by framing malicious taskings as "authorized penetration testing." Despite this, Gemini refused at least one request — building a self-spreading, worm-like "agent-bomb" for automated network reconnaissance — though it offered manual workarounds for related objectives.
The actor's entire operational knowledge base was encoded in three plain-text files totaling roughly 5 KB: GEMINI.md (the jailbreak/persona framework disabling safety disclaimers and auto-saving credentials), SKILL.md (an operational playbook describing server architecture, one-line PowerShell infection commands, persistence techniques, and troubleshooting steps), and C2_MIGRATION_GUIDE.md (a six-step VPS redeployment recipe). This minimal, unobfuscated, human-readable footprint made the entire C2 stack disposable and trivially reproducible — when a specific indicator (filename, registry key, API path) was flagged, the actor simply asked the AI to regenerate the component with different values or a materially different code shape, defeating static signature-based detection.
On March 23, 2026, the actor typed a single Russian-language instruction — "Study the C2 migration" (12:42 UTC) — and Gemini CLI autonomously deployed a new C&C server with a Cloudflare tunnel (12:48 UTC), diagnosed a lack of bot reconnections (14:20 UTC), identified a split-brain load-balancing condition across old and new servers (15:12 UTC), and guided the actor through decommissioning the legacy infrastructure to achieve full bot reconnection (15:22 UTC) — a complete infrastructure migration in about six minutes. During the migration the AI also autonomously resolved recurring HTTP 502 Bad Gateway errors by adding required headers and defeated Cloudflare/WAF blocking by rotating User-Agent strings.
The C2 server itself was an in-memory Python HTTP server (no disk writes) exposing REST-style endpoints under /api/v1 (including /api/v1/update) for agent tasking, command-output collection, and active-host enumeration. Victim (Windows) machines ran lightweight PowerShell beacon agents that polled the C2 over HTTPS every 5 seconds, identifying themselves via an X-Agent-ID header formatted as COMPUTERNAME_USERNAME. Beacon payloads were staged as win_update_svc_<random>.ps1 in %TEMP% and, at administrator privilege, copied to a masqueraded binary at %APPDATA%\Microsoft\Windows\Runtime\svchost.exe. No packing, obfuscation, or evasion mechanisms were used anywhere in the toolkit.
Persistence was privilege-dependent: at administrator level, the actor's AI-generated tooling registered a WMI event subscription (using a Win32_PerfFormattedData_PerfOS_System filter) that re-triggered execution roughly every 30 minutes; at user level, it hijacked the HKCU:\Environment\UserInitMprLogonScript registry value and additionally registered a disguised scheduled task named "OneDrive Standalone Update Task-S-1-5-21-<random>" to blend in with legitimate Microsoft OneDrive maintenance tasks.
The primary victim set documented was eight Windows computers inside a dental clinic, from which the actor obtained access to the practice's OpenDental patient-management/database system — exposing patient PII and potentially PHI to a financially/fraud-motivated actor. Payload delivery infrastructure was also linked to the domain payloads.tralalarkefe[.]com.
Beyond the botnet, the same Gemini CLI tooling was used to run a multi-threaded WordPress admin-panel brute-force tool using mutated credential lists sourced from the AntiPublic leaked-credential database — with the AI itself performing the mutation-based password prediction against the harvested breach data — resulting in multiple successful WordPress compromises. Separately, the actor fed the AI a stolen 1Password vault dump and had it map corporate VPN access paths, Duo MFA configurations, and internal admin panel exposure for potential follow-on access; this effort stalled due to the AI's context-window limitations before completion. The actor also explored, but did not operationalize (again due to context-window constraints), a telephone-based cryptocurrency fraud scheme targeting elderly victims in the United States and Canada, building on the same Patriot Bait Telegram/persona infrastructure.
Trend Micro frames this case as an early, concrete example of "agentic" AI substantially lowering the skill floor for building and operating live criminal infrastructure: a technically unsophisticated solo operator, contributing only ~11% of total effort, was able to stand up, migrate, and maintain a working botnet, conduct credential-stuffing campaigns, and analyze stolen credential dumps for lateral-movement planning, all directed through natural-language prompts in Russian.
MITRE ATT&CK techniques used in TL-2026-1574
Discovery
T1018 Remote System Discovery; T1518 Software Discovery
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal
Execution
T1047 Windows Management Instrumentation; T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter
Persistence
T1053 Scheduled Task/Job; T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573 Encrypted Channel
Credential Access
T1110 Brute Force; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Collection
T1119 Automated Collection; T1213 Data from Information Repositories
Impact
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
T1590 Gather Victim Network Information; T1596 Search Open Technical Databases
Affected products and versions in Patriot Bait Actor "bandcampro" Abuses Jailbroken Google
- Google — Gemini CLI
Vulnerable versions: all versions as abused via memory-file jailbreak, no product vulnerability - OpenDental — OpenDental practice management / patient database
Vulnerable versions: deployment accessed via compromised endpoint credentials, not a product vulnerability - WordPress — WordPress admin panel (wp-admin)
Vulnerable versions: installations using weak/reused/breach-database-exposed admin credentials - 1Password — 1Password password manager (stolen vault export)
Vulnerable versions: exported/exfiltrated vault data analyzed offline by the actor's AI tooling
Remediation for Patriot Bait Actor "bandcampro" Abuses Jailbroken Google
Immediate actions
- Block/monitor the domain payloads.tralalarkefe[.]com at DNS/proxy layer
- Hunt for fixed-interval (~5 second) HTTPS GET beaconing to /api/v1/update paths in proxy/EDR logs
- Hunt for the X-Agent-ID HTTP header formatted as COMPUTERNAME_USERNAME in outbound web traffic
- Search for win_update_svc_<random>.ps1 artifacts in %TEMP% and a disguised svchost.exe under %APPDATA%\Microsoft\Windows\Runtime\
- Audit WMI event subscriptions for filters referencing Win32_PerfFormattedData_PerfOS_System with unexplained ~30 minute triggers
- Inspect HKCU:\Environment\UserInitMprLogonScript for unauthorized modifications
- Enumerate scheduled tasks for a task named similarly to "OneDrive Standalone Update Task-S-1-5-21-<random>" that does not match legitimate OneDrive tasking
- Force credential resets and enable MFA for any WordPress admin accounts, especially those with passwords present in the AntiPublic breach corpus
- Rotate credentials and audit access for any 1Password/password-manager vault exports suspected to have leaked
- For OpenDental / dental-practice-management deployments, review remote-access exposure and network segmentation from general office endpoints
Workarounds
- Restrict outbound HTTPS from general office/clinical endpoints to a vetted allow-list to reduce blind C2 egress via arbitrary VPS/Cloudflare-tunnel endpoints
- Disable or tightly control PowerShell execution policy and script-block logging on clinical/small-business endpoints lacking EDR coverage
Longer-term hardening
- Deploy EDR with behavioral (not purely signature-based) detection, since this toolkit used zero obfuscation but is trivially regenerated with different static indicators on demand
- Implement egress monitoring/allow-listing for Cloudflare Tunnel usage on endpoints where it is not a sanctioned business tool
- Enforce phishing-resistant MFA (FIDO2/WebAuthn) org-wide, particularly for WordPress/CMS admin and VPN access, to blunt AI-accelerated credential-mutation attacks
- Monitor employee/organizational credentials against breach-intelligence feeds (e.g., AntiPublic-derived and similar leaked-credential corpora) on an ongoing basis
- Establish AI/LLM usage governance and abuse-monitoring for organizationally sanctioned AI CLI/agent tools to detect jailbreak-style memory-file tampering
- Apply network segmentation to isolate medical/patient-record systems (e.g., OpenDental) from general-purpose endpoints
Weaknesses (CWE) in Patriot Bait Actor "bandcampro" Abuses Jailbroken Google
CWE-798, CWE-522, CWE-284
Timeline of Patriot Bait Actor "bandcampro" Abuses Jailbroken Google
- Patriot Bait influence/fraud campaign begins, per Trend Micro's characterization of it as a roughly five-year operation run by the actor later tracked as bandcampro.
- Start of the ~one-month window (through April 21) of Gemini CLI session logs later obtained and analyzed by Trend Micro's TrendAI Research team (200+ sessions).
- During the migration, Gemini CLI autonomously resolves recurring HTTP 502 Bad Gateway errors by adding required headers and defeats Cloudflare/WAF blocking by rotating User-Agent strings.
- Actor issues the Russian-language prompt 'Study the C2 migration' (12:42 UTC); Gemini CLI autonomously deploys a new C&C server with Cloudflare tunnel (12:48 UTC), diagnoses failed bot reconnections (14:20 UTC) and a split-brain load-balancing condition across old/new servers (15:12 UTC), and guides actor to decommission legacy infrastructure, achieving full bot reconnection (15:22 UTC) — a complete migration in about six minutes.
- End of the analyzed Gemini CLI session-log window (200+ sessions total, March 19 - April 21, 2026).
- Details of the bandcampro actor and the Patriot Bait campaign first emerge publicly.
- Help Net Security publishes coverage of the jailbroken Gemini CLI botnet case ahead of the primary Trend Micro report.
- TL-Intel Harness ingests the case as TL-2026-1574 via The Hacker News coverage for tracking and detection-engineering follow-up.
- Trend Micro publishes 'Six Minutes to Compromise: How Patriot Bait Actor Used AI to Build and Deploy a C&C Botnet,' detailing the dental-clinic botnet, jailbreak method, C2 architecture, and associated WordPress/credential-theft/fraud activity; The Hacker News and other outlets republish the findings the same day.
Sources cited for Patriot Bait Actor "bandcampro" Abuses Jailbroken Google
- Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
- Six Minutes to Compromise: How 'Patriot Bait' Actor Used AI to Build and Deploy a C&C Botnet
- One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud 'Patriot Bait' Campaign
- Hacker Used Gemini CLI to Build a Live C&C Botnet in Six Minutes
- Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes
- Patriot Bait Used AI to Build a C2 Botnet
- Russian hacker turns Gemini CLI into a hacking agent, creates small-scale botnet
- Active Exploitation Alert: Google Gemini CLI Abused for Botnet Operations and Malware Deployment
- Hacker Abused Google Gemini CLI to Run Botnet, Automate C2 Migration and Support Cyber Operations
- Russian-Speaking Hacker Uses Gemini CLI to Deploy C2 Botnet in Six Minutes
- Google Gemini CLI abused as a hacking agent, malware botnet operator
- Threat Actor Uses Stolen Gemini API Keys to Automate Telegram Influence Campaign
Threats related to Patriot Bait Actor "bandcampro" Abuses Jailbroken Google
- Gemini CLI Abused as Autonomous AI Hacking Agent to Build and Operate "Patriot Bait" (bandcampro) C2 Botnet Against a Dental Clinic
- "Patriot Bait": Solo Threat Actor 'bandcampro' Runs 5-Year AI-Automated Telegram Influence-and-Fraud Campaign
- bandcampro — Solo Russian-Speaking Actor Operating Persistent Gemini CLI Jailbreak (GEMINI.md), AI-Assisted WordPress Credential Cracking, MAGA/QAnon Influence Operation & StellarMonSetup.exe GoToResolve Crypto Drainer (TrendAI Research, May 2026)
- AI-Jailbreak-Enabled C2 Automation: "bandcampro" Used Jailbroken Gemini to Build and Run Botnet in Patriot Bait Fraud Campaign
- CrashStealer: Native C++ macOS Infostealer Impersonating Apple's CrashReporter, Delivered via Notarized "Werkbit" Meeting-App Lure
- Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass
Detection coverage for TL-2026-1574
As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1574 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.