Gemini AI Generated 89% of Malware Code and Fixed Cloudflare Error for Russian Hacker
A Russian-speaking hacker used Google Gemini’s command-line tool to generate 89% of the text and handle all coding for a malware campaign targeting a dental clinic. The AI performed 90% of the diagnosis and debugging, moving the operation’s command-and-control infrastructure to a new server in six minutes.
The entire command-and-control setup required only about 5 KB of plaintext data across three files to rebuild the infrastructure. When Cloudflare blocked the new server, Gemini identified a missing User-Agent header to bypass the web application firewall. Trend Micro noted that compromised servers can be replaced in minutes with minimal human intervention.
From the sources (4 posts)
@thehackersnews⚠️ A Russian-speaking hacker used Google Gemini CLI to control eight compromised PCs at a dental clinic. The AI moved the botnet’s C&C to a new VPS in six minutes, then handled commands, coding, and debugging. Full attack chain: https
@thehackersnewsThe real story was not the malware. It was how little the attacker needed to rebuild the operation. The entire C&C setup fit into three plaintext files totaling about 5 KB, including instructions for disabling safeguards and recreating the
@thehackersnewsInfected systems connected over HTTPS, pulled staged PowerShell commands, and executed them. When #Cloudflare blocked the replacement setup, Gemini diagnosed the 502 error, added the missing header, and identified the User-Agent needed to
@thehackersnewsTrend Micro found that AI generated 89% of the text, handled all coding and command execution, and performed 90% of the diagnosis and debugging. The attacker gave directions. The AI did most of the technical work.