BandCamPro 'Patriot Bait' Campaign: AI-Deployed C2 Botnet via Google Gemini CLI — OTX Pulse Analysis & Healthcare Detection Pack

---
title: BandCamPro C2 Communication - Tralalarkefe Domain
description: Detects DNS resolution or network connection to the bandcampro 'Patriot Bait' botnet C2 domain identified in AlienVault OTX pulse analysis
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|contains:
      - 'tralalarkefe.com'
  condition: selection
falsepositives:
  - Threat hunting or sandbox detonation of this briefing's IOCs
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
date: 2026/08/15
---
title: Suspicious Gemini CLI Execution on Non-Developer Endpoint
description: Detects execution of Google Gemini CLI tooling on endpoints, associated with AI-assisted malware development by the bandcampro threat actor
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\gemini.exe'
      - '\node.exe'
  selection_cmdline:
    CommandLine|contains:
      - 'gemini'
      - 'gemini-cli'
  filter_approved_paths:
    Image|startswith:
      - 'C:\Program Files\Google\'
  condition: (selection_image and selection_cmdline) and not filter_approved_paths
falsepositives:
  - Legitimate developer workstations using Gemini CLI for sanctioned work
level: high
tags:
  - attack.execution
  - attack.t1059
date: 2026/08/15
---
title: Persistence Artifact Creation Followed by Rare Outbound Connection
description: Detects Run key or scheduled task persistence creation patterns consistent with AI-generated botnet agent installation observed in the Patriot Bait campaign
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\CurrentVersion\Run\'
      - '\CurrentVersion\RunOnce\'
    Details|contains:
      - 'AppData'
      - 'Temp'
      - 'Public'
  condition: selection
falsepositives:
  - Legitimate user-space software installers registering auto-start entries
level: medium
tags:
  - attack.persistence
  - attack.t1060
  - attack.t1547.001
date: 2026/08/15

// BandCamPro 'Patriot Bait' Hunt — C2 resolution, Gemini CLI abuse, and persistence correlation
// Microsoft Sentinel / Microsoft Defender XDR
let C2Domains = dynamic(["tralalarkefe.com"]);
let Lookback = 30d;
let DnsHits = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (C2Domains)
    | project DnsTime=TimeGenerated, DeviceName, DnsRemoteUrl=RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId;
let GeminiExec = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("gemini", "gemini-cli") or FileName =~ "gemini.exe"
    | project GeminiTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName;
let Persistence = DeviceRegistryEvents
    | where TimeGenerated > ago(Lookback)
    | where RegistryKey has_any (@"\CurrentVersion\Run", @"\CurrentVersion\RunOnce")
    | where RegistryValueData has_any ("AppData", "Temp", "Public")
    | project PersistTime=TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName;
DnsHits
| join kind=leftouter (GeminiExec) on DeviceName
| join kind=leftouter (Persistence) on DeviceName
| project DeviceName, DnsTime, DnsRemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine,
          GeminiTime, ProcessCommandLine, PersistTime, RegistryKey, RegistryValueData
| sort by DeviceName asc, DnsTime desc

# BandCamPro 'Patriot Bait' IOC Hunt Script
# Checks for C2 connections, persistence artifacts, and Gemini CLI presence
# Run elevated on suspected endpoints; export results per host

$Report = @()
$C2Domain = "tralalarkefe.com"

Write-Host "[1/5] Checking DNS cache for C2 resolution..." -ForegroundColor Cyan
$DnsHits = Get-DnsClientCache | Where-Object { $_.Entry -like "*$C2Domain*" }
if ($DnsHits) {
    $Report += [PSCustomObject]@{ Check="DNS Cache"; Finding="C2 domain resolved"; Detail=($DnsHits.Entry -join ', ') }
}

Write-Host "[2/5] Checking active network connections..." -ForegroundColor Cyan
$Connections = Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{ LocalPort=$_.LocalPort; RemoteAddress=$_.RemoteAddress; RemotePort=$_.RemotePort; Process=$proc.ProcessName; Path=$proc.Path }
    }
$SuspiciousConns = $Connections | Where-Object {
    try { (Resolve-DnsName -Name $C2Domain -ErrorAction Stop).IPAddress -contains $_.RemoteAddress } catch { $false }
}
if ($SuspiciousConns) {
    $Report += [PSCustomObject]@{ Check="Network"; Finding="Active connection to C2 IP"; Detail=($SuspiciousConns | Out-String) }
}

Write-Host "[3/5] Auditing Run/RunOnce persistence keys..." -ForegroundColor Cyan
$RunKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        Get-ItemProperty -Path $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty -Path $key -Name $_.Name).$($_.Name)
            if ($val -match 'AppData|Temp|Public' -and $val -notmatch 'Microsoft|OneDrive|Teams') {
                $Report += [PSCustomObject]@{ Check="Persistence"; Finding="Suspicious Run key: $($_.Name)"; Detail="$key -> $val" }
            }
        }
    }
}

Write-Host "[4/5] Checking scheduled tasks for user-space binaries..." -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $action = $_.Actions.Execute
    if ($action -match 'AppData|Temp|Public' -and $action -notmatch 'Microsoft') {
        $Report += [PSCustomObject]@{ Check="ScheduledTask"; Finding="Suspicious task: $($_.TaskName)"; Detail=$action }
    }
}

Write-Host "[5/5] Checking for Gemini CLI artifacts..." -ForegroundColor Cyan
$GeminiPaths = @("$env:LOCALAPPDATA\gemini", "$env:USERPROFILE\.gemini", "$env:APPDATA\npm\gemini*")
foreach ($p in $GeminiPaths) {
    if (Test-Path $p) {
        $Report += [PSCustomObject]@{ Check="GeminiCLI"; Finding="Gemini CLI artifact present"; Detail=$p }
    }
}

if ($Report.Count -gt 0) {
    $Report | Format-Table -AutoSize
    $Report | Export-Csv -Path ".\BandCamPro_Hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
    Write-Host "[!] Findings exported to BandCamPro_Hunt_$env:COMPUTERNAME.csv" -ForegroundColor Red
} else {
    Write-Host "[+] No indicators found on this host." -ForegroundColor Green
}