TrendAI Research analyzed 200 Gemini CLI session logs from the Russian-speaking threat actor 'bandcampro,' revealing a solo operator who used Google Gemini CLI as the primary engineering agent to deploy and operate a C&C botnet targeting a dental clinic. The AI handled architecture design, coding, deployment, debugging, and WAF bypass autonomously, migrating the entire C&C infrastructure in six minutes. The operation is encoded in three portable plain-text files (~5KB) that can be shared and deployed by non-technical actors, representing a paradigm shift where AI lowers the skill barrier for complex cyber operations and makes infrastructure disposable and rapidly rebuildable.
WMI
3 posts
Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet Beware of Phishing Emails Disguised as Money Transfer Confirmations A phishing campaign targeting Korean organizations delivers malicious XLS files disguised as payment confirmation notices. The XLS files exploit CVE-2017-0199 to download and execute an HTA file, which in turn launches an obfuscated PowerShell script via WMI. The PowerShell script retrieves a steganographically embedded PNG containing a .NET loader, which ultimately downloads and executes Remcos RAT for persistent remote access and data exfiltration.
Intelligence Center Cisco Talos introduced DispatchLogger, an open-source dynamic analysis tool designed to intercept and log late-bound COM automation calls. By utilizing transparent proxying and recursive object wrapping, the tool provides analysts with deep semantic visibility into script-based malware behavior, such as WMI abuse and fileless execution, effectively bypassing common script obfuscation techniques.
