Attack Scenario: 'bandcampro' Uses Google Gemini CLI to Hijack Dental Networks — Defense Guide

The convergence of Artificial Intelligence and offensive cyber operations is no longer theoretical. Recent analysis of session logs from March 19 to April 21, 2026, reveals that a Russian-speaking threat actor, tracked as "bandcampro," has actively weaponized the open-source Google Gemini CLI to streamline the compromise of healthcare networks. Specifically, eight dental clinic PCs were commandeered using this tool.

For defenders, this signals a critical shift: attackers are now outsourcing operational overhead—password cracking, proxy configuration, and scripting—to AI agents running directly on compromised endpoints. This reduces the "time-to-crown" and allows even solo actors to manage complex botnets with minimal manual effort. Healthcare providers, often targeted for their high-value data and sometimes lax perimeter security, must immediately adapt their detection logic to identify AI-assisted command-and-control (C2) behaviors.

Technical Analysis

Affected Environment:

• Sector: Healthcare (Dental Clinics)
• Platform: Windows-based endpoints (implied by "PCs" and standard dental practice management software environments)
• Tool in Abuse: Google Gemini CLI (open-source)

Attack Chain & Mechanism:

1. Initial Access: While the specific initial access vector (IAV) for these clinics wasn't fully disclosed in the logs, actors targeting dental practices frequently leverage exposed Remote Desktop Protocol (RDP), phishing, or unpatched public-facing applications.

2. Tool Deployment: Once access is established, the actor deploys the Google Gemini CLI onto the compromised host. This allows the attacker to interact with Google's Generative AI models via a command-line interface rather than a web browser.

3. AI-Augmented Operations: The logs indicate the actor used the AI to:

   • Crack Passwords: Likely by asking the AI to generate complex password mutation lists, write Python scripts for hash cracking, or analyze previously dumped credential material.
   • Set up Residential Proxies: The actor instructed the CLI to configure the machine to act as a residential proxy node. This obfuscates the actor's origin traffic, blending malicious traffic in with legitimate residential IP ranges.
   • Network Discovery/Automation: Using natural language processing to generate scripts for lateral movement or network mapping.

Exploitation Status:

• Status: Confirmed Active Exploitation (based on analysis of 200 session logs).
• Actor: "bandcampro" (Russian-speaking, solo operator).

This attack does not rely on a specific software vulnerability (CVE) but rather on the abuse of capabilities. The threat lies in the unauthorized execution of the AI tooling and the malicious intent of the prompts processed by it.

Detection & Response

Detecting this activity requires monitoring for the unauthorized presence of the CLI itself and the specific, high-risk behaviors it facilitates. Standard antivirus may flag the executable as "hacktool" or "riskware," but in a clinical environment where IT staff may use various utilities, behavioral detection is superior.

SIGMA Rules

---
title: Google Gemini CLI Execution on Endpoint
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects the execution of the Google Gemini CLI (gemini) or Python wrappers executing it. Observed in use by threat actor "bandcampro" in dental clinic compromises.
references:
  - https://thehackernews.com/2026/07/russian-speaking-hacker-uses-google.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\gemini.exe'
      - '\gemini.cmd'
    # Catching python execution of the CLI library
    or:
    Image|endswith:
      - '\python.exe'
    CommandLine|contains:
      - 'gemini-cli'
      - 'google.generativeai'
falsepositives:
  - Legitimate developer usage (rare in clinical environments)
level: high
---
title: Suspicious Proxy Configuration via CLI
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects command line arguments suggesting the setup of residential proxies or network tunneling, often automated via AI CLI tools in the "bandcampro" campaign.
references:
  - https://thehackernews.com/2026/07/russian-speaking-hacker-uses-google.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1090.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\python.exe'
  selection_keywords:
    CommandLine|contains:
      - 'residential proxy'
      - 'proxy set'
      - 'tunnel'
      - 'socks5'
      - 'port forwarding'
  condition: all of selection_*
falsepositives:
  - Authorized IT administration of VPNs or proxy settings
level: medium

KQL (Microsoft Sentinel / Defender)

// Hunt for Gemini CLI execution and proxy-related activities
DeviceProcessEvents
| where Timestamp >= datetime(2026-03-19)
| where ProcessName has "gemini" 
   or ProcessCommandLine has_any ("gemini", "google.generativeai")
   or (ProcessCommandLine has "proxy" and ProcessCommandLine has "setup")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc

Velociraptor VQL

-- Hunt for Gemini CLI artifacts and processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "gemini"
   OR CommandLine =~ "gemini-cli"
   OR CommandLine =~ "google.generativeai"

-- Check for recent file creations in common user directories
SELECT FullPath, Size, Mtime
FROM glob(globs="/*")
WHERE FullPath =~ "gemini" 
  AND Mtime > now() - 90d

Remediation Script (PowerShell)

# Remediation Script for 'bandcampro' Gemini CLI Activity
# Run as Administrator

Write-Host "Starting hunt for unauthorized Google Gemini CLI instances..." -ForegroundColor Cyan

# 1. Terminate malicious processes
$maliciousProcs = Get-Process -Name "gemini" -ErrorAction SilentlyContinue
if ($maliciousProcs) {
    Write-Host "Terminating process 'gemini'..." -ForegroundColor Yellow
    $maliciousProcs | Stop-Process -Force
} else {
    Write-Host "No 'gemini' processes found running." -ForegroundColor Green
}

# 2. Check for common installation paths (User profile and Program Files)
$suspiciousPaths = @(
    "$env:LOCALAPPDATA\Programs\gemini",
    "$env:USERPROFILE\gemini-cli",
    "C:\Program Files\gemini"
)

foreach ($path in $suspiciousPaths) {
    if (Test-Path $path) {
        Write-Host "[!] Alert: Suspicious directory found at $path" -ForegroundColor Red
        # Optional: Remove-Item -Path $path -Recurse -Force (Uncomment after verification)
    }
}

# 3. Review recent network connections (Requires Admin)
Write-Host "Checking for established proxy-like connections (Non-standard ports)..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established | 
    Where-Object { $_.RemotePort -gt 1024 -and $_.RemoteAddress -notlike "127.*" -and $_.RemoteAddress -notlike "10.*" -and $_.RemoteAddress -notlike "192.168.*" } | 
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess | 
    Format-Table -AutoSize

Write-Host "Remediation script complete. Please review outputs and initiate credential resets." -ForegroundColor Green

Remediation

Immediate containment and eradication are required for any identified "bandcampro" activity.

1. Isolate Affected Hosts: Immediately disconnect the compromised PCs from the network (both wired and wireless) to prevent further lateral movement or data exfiltration via the proxy setup.

2. Credential Reset: Because the actor utilized AI to crack passwords, assume all credentials cached or used on the compromised machines are compromised. Force a password reset for all users who logged into the affected systems within the last 90 days. Enforce Multi-Factor Authentication (MFA) immediately if not already active.

3. Artifact Removal: Uninstall the Google Gemini CLI and delete any associated scripts generated during the intrusion. Check for unauthorized user accounts created during the compromise window.

4. Network Firewall Review: Inspect firewall logs for unauthorized outbound connections characteristic of residential proxy services. Block IP ranges identified as C2 or proxy nodes.

5. Policy Enforcement: Update acceptable use policies to explicitly prohibit the installation of unauthorized AI CLI tools on clinical workstations. Implement Application Control (AppLocker) to whitelist only approved medical and administrative software.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub