The Oddest Botnet Yet: Eight Dental Chairs, One AI Operator

Some hackers dream of massive server farms. This one settled for eight dental clinic PCs. A solo threat actor known as “bandcampro” has been caught running a small but functional botnet — and the brains behind it aren’t entirely human.

According to an analysis of 200 Google Gemini CLI session logs captured between March 19 and April 21, 2026, the Russian-speaking operator outsourced a surprising chunk of his workflow to Google’s open-source command-line AI. The result? A live botnet controlled with a mix of old-school hacking tricks and cutting-edge large language model assistance.

The scale is almost comically small — eight compromised machines inside a dental practice network. But the implications are anything but. This is the first documented case of a threat actor using Gemini CLI as a core command-and-control tool.

What the Gemini CLI Logs Reveal

The session logs paint a detailed picture of how bandcampro operated. He wasn’t just using the AI to write phishing emails — the kind of low-hanging fruit we’ve seen before. Instead, he put Gemini CLI to work on the unglamorous, technical grind of running a botnet.

Among the tasks the AI helped with:

• Cracking weak passwords on exposed remote desktop services
• Setting up a residential proxy chain to hide the botnet’s true origin
• Drafting PowerShell scripts to maintain persistence on infected machines
• Parsing network scan data to identify which dental clinic PCs were worth keeping

That’s not a toy. That’s a junior sysadmin’s job description, automated and weaponized.

Why Dental Clinics?

It’s easy to laugh at the target selection. But dental practices are a rational choice for a small-time operator. They tend to have older Windows machines, minimal IT staff, and — critically — a stable internet connection. Eight PCs might not sound like much, but for a solo hacker looking to rent out proxy access or mine cryptocurrency, it’s enough to turn a small profit.

The Mechanics of an AI-Driven Attack Chain

The logs show a workflow that would look familiar to any penetration tester — except for the copilot in the driver’s seat. Bandcampro would feed Gemini CLI raw output from scanning tools like Nmap, then ask it to interpret the results and suggest next steps.

In one session, the AI generated a brute-force wordlist tailored to the dental practice’s naming conventions. In another, it refactored a credential-stealing script on the fly. The hacker wasn’t a coding wizard. He didn’t need to be. The AI filled in the gaps.

What’s striking is the division of labor. The human made the high-level decisions — which targets to hit, when to pivot. The AI handled the tedious execution. That’s a template we’re likely to see replicated across the cybercrime ecosystem.

The Open-Source Double-Edged Sword

Google released Gemini CLI as an open-source tool in late 2025, positioning it as a developer productivity booster. It can read files, execute commands, and even modify code — all from a terminal. For legitimate developers, it’s a godsend. For a hacker with modest coding skills, it’s a force multiplier.

The logs analyzed by researchers show no evidence that Google’s safety filters were bypassed. The AI didn’t refuse to help — because the requests weren’t obviously malicious. “Help me parse this log file” isn’t a crime. Neither is “write a script to test password strength.” Context matters, and context is exactly what a CLI tool lacks.

This is the core problem. Open-source AI tools are built for speed and flexibility, not for policing user intent. And once the model weights are public, there’s no real way to lock them down.

What This Means for the Future of Cybercrime

Security researchers have been warning about AI-powered attacks for years. Most of that talk was theoretical. This case makes it concrete.

We’re not looking at a nation-state actor with unlimited resources. We’re looking at a solo operator who used a free, open-source AI tool to run a live botnet. The barrier to entry for cybercrime just dropped again.

Consider the implications for defenders. Traditional detection relies on spotting known malware signatures or anomalous network traffic. But when the attacker’s commands are generated by an AI that writes unique scripts on the fly, those signatures become meaningless. Every attack is bespoke.

There’s also a cat-and-mouse element. As AI tools improve, so will their abuse. The next bandcampro might use Gemini CLI to automate reconnaissance across thousands of targets, or to write polymorphic malware that mutates with each infection. The dental clinic botnet is a proof of concept — and it worked.

What Google Can Do (and What It Can’t)

Google has a responsible disclosure process and safety classifiers on its consumer AI products. But Gemini CLI is open source. That means anyone can modify it, strip out safety layers, or run it offline. The genie is out of the bottle.

What Google can do is monitor for abuse patterns in telemetry from cloud-hosted versions of the tool, and build better prompt-injection defenses. But for locally run instances, there’s little the company can do beyond issuing guidance.

Protecting Small Businesses From AI-Assisted Attacks

The dental clinic in question likely never saw this coming. Small and medium businesses are the most exposed — they have valuable data but rarely the security budget to defend it.

If there’s a takeaway from this incident, it’s that basic hygiene still matters. Multi-factor authentication would have stopped the initial password cracking. Network segmentation would have limited the blast radius. Regular patching would have closed the vulnerabilities the attacker exploited.

None of these are glamorous. But they’re effective — even against an adversary with an AI assistant on his side.

As for bandcampro, the session logs are now in the hands of researchers and likely law enforcement. Whether he’ll face consequences remains unclear. What’s certain is that the playbook he used is now public. And somewhere, another solo hacker is already asking an AI how to improve it.

The Short Version: Update 7-Zip Right Now

If you use 7-Zip — and let’s be honest, millions of you do — there’s a newly disclosed flaw that deserves your attention. It’s tracked as CVE-2026-14266, and it’s a heap-based buffer overflow in how the archiver handles XZ chunked data. An attacker who gets you to open a specially crafted XZ archive could run code on your machine.

The good news? A patch shipped on June 25 in 7-Zip 26.02. The bad news? Many users never update third-party tools, which is exactly what makes this dangerous.

Trend Micro’s Zero Day Initiative (ZDI) published the technical details on July 15, giving researchers and attackers alike a roadmap to build exploits.

What Exactly Is CVE-2026-14266?

This isn’t a vague, theoretical weakness. It’s a concrete memory corruption bug in 7-Zip’s XZ decompression logic. When the software processes XZ files with malformed chunked data, the overflow lets an attacker “execute code in the context of the current process,” per the ZDI advisory.

In plain terms: open the wrong file, and the attacker’s code runs with your user privileges. That could mean installing malware, stealing credentials, or pivoting to other systems on your network.

Why XZ Archives Are the Attack Vector

XZ is a popular compression format, especially in Linux and open-source circles. It’s not as ubiquitous as ZIP, but it’s common enough that users let their guard down. Attackers know that. They’ll craft a malicious XZ file, name it something innocuous like invoice.xz or patch.xz, and wait for someone to double-click.

The flaw specifically resides in how 7-Zip allocates memory for chunked data. A heap-based buffer overflow occurs when the program writes more data to a memory region than it can hold. In this case, that overflow can be weaponized to redirect execution flow.

How Serious Is This Really?

Let’s put it in perspective. This isn’t a remote code execution bug that requires no user interaction — you still have to open the file. But that’s a low bar. Phishing emails, malicious downloads, and poisoned USB drives all rely on users opening files.

ZDI’s severity rating hasn’t been fully disclosed in the public summary, but the description alone warrants urgency. Code execution bugs in file archivers have a long history of being exploited in the wild. Remember the WinRAR flaw from 2019? That one let attackers plant malware in startup folders via ACE archives. The 7-Zip XZ vulnerability is cut from similar cloth.

One mitigating factor: 7-Zip runs with the privileges of the current user. So if you’re on a standard account, the blast radius is limited. But if you’re an admin — and many home users are — the attacker gets full control.

What You Should Do About This 7-Zip XZ Vulnerability

The fix is straightforward, but only if you actually do it:

• Update to 7-Zip 26.02 or later. The patch shipped on June 25. If you’re on an older version, you’re exposed.
• Enable automatic updates. 7-Zip doesn’t auto-update by default. Check your version manually if you’re unsure.
• Be wary of XZ files from untrusted sources. Even with the patch, treat unexpected archives with suspicion.
• Consider using a standard user account. Limiting privileges reduces the impact of any future bug.

To check your version, open 7-Zip and go to Help → About. If it says anything before 26.02, head to the official 7-Zip website and download the latest build.

The Bigger Picture: Archivers Are a Prime Target

File archivers are a juicy target for attackers because they process untrusted data constantly. You download a file, extract it, and never think twice. That trust is exactly what gets exploited.

This isn’t 7-Zip’s first security rodeo, either. The software has seen its share of CVEs over the years, from path traversal issues to other memory corruption bugs. Each one reinforces the same lesson: keep your tools updated.

If you want to dig deeper into how similar flaws work, check out our piece on how archive-based attacks bypass security software. And for a broader look at compression format risks, read about why XZ files are becoming a favorite for malware distribution.

Final Thoughts

Here’s the thing: a single update click takes ten seconds. Recovering from a compromised machine takes hours, sometimes days. The 7-Zip XZ vulnerability is a reminder that even trusted tools need regular attention.

Update to 26.02, stay cautious with archives, and don’t assume you’re safe just because you’ve never had a problem before. Attackers are counting on that complacency.

Zero-Days Hit SonicWall SMA 1000 Before Patches Existed

A previously undocumented threat actor exploited multiple zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as early as June 22, 2026 — weeks before SonicWall publicly disclosed the flaws. The attacks weren’t just reconnaissance. They resulted in full root access on affected devices.

Security firm Volexity uncovered the campaign during an incident response investigation. The company is tracking the attacker under the moniker UTA0533. That’s a name you’ll want to remember, because this actor is patient, methodical, and clearly well-resourced.

The timeline matters here. Exploitation began in late June. Public disclosure didn’t happen until later. That gap — the zero-day window — is exactly what UTA0533 exploited to compromise devices before administrators even knew there was a problem.

What Volexity Found: Root Access, Not Just Footholds

Volexity’s investigation revealed that the attackers weren’t satisfied with simple unauthorized access. They escalated privileges to root on the SMA 1000 appliances. That level of access means full control over the VPN gateway — the very device organizations trust to secure remote connections.

Once root is achieved, an attacker can:

• Modify VPN configurations to redirect traffic
• Harvest credentials and session tokens
• Deploy persistent backdoors
• Lateral movement into the internal network

This isn’t a theoretical risk. It’s a confirmed campaign with real victims. Volexity’s report details the attack chain, though the company has withheld some specifics to allow organizations time to patch.

How the Exploitation Worked

While full technical details remain under wraps, Volexity’s analysis points to a combination of vulnerabilities in the SMA 1000 series. The flaws were chained together to achieve remote code execution, then privilege escalation to root.

The attack vector appears to be unauthenticated — meaning no valid credentials were required to trigger the initial compromise. That’s a worst-case scenario for exposed appliances.

Volexity noted that the actor’s tactics, techniques, and procedures (TTPs) don’t match any known group. UTA0533 appears to be a new or previously uncatalogued threat actor. That adds another layer of concern, because defenders can’t rely on existing threat intelligence to spot this group.

SonicWall’s Response and Patch Status

SonicWall released security advisories after Volexity reported the findings. The company has published patches for the SMA 1000 series, and administrators are urged to apply them immediately.

If you’re running an SMA 1000 appliance, here’s what you should do right now:

1. Apply the latest firmware update from SonicWall
2. Check for indicators of compromise provided in Volexity’s advisory
3. Review VPN logs for unusual activity dating back to June 22, 2026
4. Rotate any credentials that may have passed through the appliance

Delaying patches is no longer an option. The zero-day window has closed, but the actors who exploited it are still active. They’re likely scanning for unpatched devices.

Why This Matters for VPN Security

VPN appliances are prime targets. They sit at the network edge, they’re internet-facing, and they often have privileged access to internal systems. The SonicWall SMA 1000 is a popular choice for mid-sized and large enterprises, which makes it an attractive target for attackers seeking high-value access.

This incident is a reminder that VPN security best practices go beyond just installing patches. You need to monitor for anomalous behavior, restrict management interfaces to trusted IPs, and assume that any internet-facing device could be compromised.

Volexity’s discovery also highlights the value of incident response readiness. The organization that called in Volexity likely avoided a much worse outcome by detecting the breach early. That’s the difference between a contained incident and a full-blown data breach.

What to Watch For Next

UTA0533 isn’t going away. Volexity expects the group to continue exploiting other vulnerabilities, possibly in different VPN products. Security teams should stay alert for new advisories from SonicWall and other vendors.

If you’re responsible for network security, now is the time to audit your edge devices. Check for unauthorized changes, review logs for failed login attempts, and ensure your incident response plan is up to date. The next zero-day could be aimed at your infrastructure.

For more on defending against such threats, see our guide on VPN vulnerability management and the latest network security threat landscape coverage.