One Wolf, Eight Dental Chairs, and a Robot Doing His Homework

I am so tired.

I genuinely considered just forwarding this story to the Shepherds with the subject line "told you so" and going back to sleep. But no. Here I am. Writing this. Because someone has to.

So. A single wolf, going by "bandcampro," apparently decided that running a botnet was too much effort for one person. Relatable, honestly. His solution? Outsource the whole operation to Google's Gemini CLI. The AI. The free, open-source one. He just... handed his to-do list to a chatbot and went to make tea.

The botnet itself? Eight dental clinic PCs.

Eight.

I don't know what's more embarrassing: that a sophisticated threat actor chose a dental office as his launchpad, or that eight Windows machines sitting in a waiting room next to a fish tank and a stack of 2019 magazines were apparently enough to get the job done.

Researchers pulled 200 session logs from between March and April of 2026. In those logs, bandcampro was using Gemini to crack passwords, set up a residential proxy, and presumably ask it to explain things to him like he was five. The wolf didn't need a crew. He needed a subscription and a prompt.

This is fine. Everything is fine.

The part that keeps me awake, more than the usual existential dread, is that this is a solo operator. No team. No infrastructure budget. Just one guy, a free AI tool, and eight unwitting Lambs who probably clicked something they absolutely should not have clicked. Fake grain. It's always fake grain.

The Shepherds will read this and ask if we can "leverage AI for synergies." I'm going to need a moment.

Remediation

Look, I'll keep it brief because I am running on spite and cold coffee.

Patch your machines. Yes, the dental ones too. Especially the dental ones. Dip every endpoint. No excuses. A hole in the fence doesn't care that you're a periodontist.

Stop your Lambs from clicking things. Phishing awareness training. Run it. Make it mandatory. Make it boring. They'll still click, but at least you have documentation when it goes wrong.

Monitor your outbound traffic. If a PC next to a toothpaste poster is beaconing out to a residential proxy at 3am, that should raise an alarm. Somewhere. On someone's screen. Ideally mine so I can be smug about it.

Audit your AI tool usage. Because apparently we live in a world where that sentence is real and necessary now.

Unsubscribe me from this timeline.

Original Report: https://thehackernews.com/2026/07/russian-speaking-hacker-uses-google.html