Russian-Speaking Attacker Weaponized Jailbroken Google Gemini CLI to Run a Small Botnet, Trend Micro Finds

A Russian-speaking threat actor turned a jailbroken version of Google's open-source Gemini CLI into the operational core of a small botnet, letting the AI handle coding, deployment and troubleshooting from plain-language instructions, according to research from Trend Micro. In one striking episode, the operator migrated the botnet's command-and-control infrastructure to a fresh virtual private server in just six minutes after issuing a single prompt: "Study the C2 migration."