AI-Orchestrated PaperCut Campaign Compromises 395 Organizations Worldwide

A likely Russian-speaking threat actor used hundreds of artificial intelligence agents to exploit vulnerable PaperCut servers, compromising at least 440 deployments belonging to 395 organizations across 48 countries.

The campaign began on August 31 and targeted PaperCut NG and PaperCut MF installations affected by two critical vulnerabilities. Attackers obtained remote code execution, harvested credentials from 280 victims, and reached domain-administrator privileges at 12 organizations.

GreyNoise found that the operation combined OpenAI Codex and DeepSeek models with Netlas, custom utilities, and widely available offensive-security tools. AI did not introduce a fundamentally new exploitation technique. Instead, it sharply accelerated exploit development, reconnaissance, validation, credential theft, and Active Directory escalation.

Hundreds of AI Agents Compressed the Attack Timeline

The actor reportedly started with an empty development workspace and achieved remote code execution against a real victim in just under four hours. Approximately two hours later, the operation recorded its first domain-administrator compromise.

Once exploitation moved to scale, at least 11 organizations were breached within 26 seconds. At one United States high school, attackers progressed from initial PaperCut access to full domain-administrator privileges in seven minutes.

That speed substantially reduced the interval between a vulnerable server being identified and the surrounding Windows domain being compromised. Traditional response assumptions—where defenders expect hours or days between exploitation stages—did not apply.

The agents helped construct and refine exploits, generate targets, test payloads, and execute campaign tasks in parallel. The supporting environment included:

• OpenAI Codex and DeepSeek models
• Netlas for internet scanning and asset discovery
• Ligolo-ng for tunneling
• Mimikatz and custom Rust utilities for credential collection
• BloodHound for Active Directory mapping
• Certipy and Rubeus for authentication and certificate-related attacks
• Impacket and NetExec for remote operations and lateral movement

The actor also instructed the agents to avoid 28 countries. Named exclusions included Russia, China, Iran, Ukraine, Belarus, Moldova, Brazil, and South Africa. Those controls were unreliable, and victims were still identified in some prohibited locations.

The United States had the largest number of targets, followed by the United Kingdom, France, Spain, and Canada. Education accounted for 204 of the 440 compromised deployments. Other affected sectors included retail, professional services, real estate, hospitality, IT providers, managed-service providers, nonprofits, libraries, manufacturing, and utilities.

Two PaperCut Flaws Enabled Unauthenticated Code Execution

The campaign exploited CVE-2026-81578 and CVE-2026-82078, which affect PaperCut NG and PaperCut MF versions earlier than 24.1.9.

The flaws were disclosed as zero-days on August 27 and patched the following day. Both entered CISA’s Known Exploited Vulnerabilities catalog on 2026-08-31, confirming active exploitation rather than merely theoretical risk.

CVE-2026-81578 is an improper access-control vulnerability in the products’ web-management interface. Under specific conditions, unauthenticated requests sent to administrative functions can trigger backend actions before access checks finish. An external attacker can therefore modify certain system configurations without valid credentials.

It has a CVSS score of 9.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

CVE-2026-82078 affects database-connection utilities that dynamically instantiate Java database-driver classes. PaperCut accepts configurable driver names without restricting them to an approved allowlist. An attacker able to modify the relevant configuration can cause Java bytecode already available on the application classpath to execute with the privileges of the PaperCut server process.

The second flaw has a CVSS score of 9.1 and the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Although CVE-2026-82078 requires elevated privileges in isolation, reporting on the campaign indicates that the two vulnerabilities could be combined to bypass authentication and execute arbitrary code remotely. The access-control weakness provided a route to configuration changes, while unsafe class loading converted that control into code execution.

CISA set a remediation deadline of 2026-09-14 for United States federal agencies. Its required action includes applying vendor mitigations, following BOD 26-04 risk-based patching guidance, and completing the agency’s forensic triage requirements. Applicable cloud-service guidance must also be followed; if mitigations are unavailable, CISA directs agencies to discontinue using the affected product.

PaperCut Access Became an Active Directory Compromise

Initial control of a print-management server was only the first stage. GreyNoise observed three principal routes from PaperCut code execution to domain-wide access.

In the first, attackers extracted LSASS memory and Windows registry secrets from domain-joined PaperCut servers. Recovered password hashes were then used in pass-the-hash attacks against domain controllers.

The second path relied on NoPac, an Active Directory escalation chain involving CVE-2021-42278 and CVE-2021-42287. Both vulnerabilities have CVSS scores of 7.5 and affect multiple Windows Server releases, including versions of Windows Server 2004, 2008, 2012, 2016, 2019, 2022, and 20H2.

Both NoPac vulnerabilities have been in the CISA KEV catalog since 2022-04-11, with a federal remediation deadline of 2022-05-02. They are also recorded as having been used in ransomware campaigns. CISA’s required action is to apply Microsoft’s updates.

The third route was more direct. Where PaperCut ran on a domain controller or used a domain-administrator service account, the attackers created a new account and placed it in the Domain Admins group.

Every observed escalation path eventually included DCSync activity. This technique impersonates domain-controller replication behavior to retrieve credential material, allowing the attackers to obtain a complete NTDS.DIT database containing domain password data.

The deployment model therefore strongly influenced impact. Running PaperCut with domain-administrator privileges—or directly on a domain controller—turned application compromise into an immediate route to the organization’s most sensitive identity infrastructure.

Credential Theft Reached Hundreds of Victims

Attackers harvested credentials from 280 victims or compromised hosts. Published counts differ on the number from which operating-system or domain secrets were successfully obtained: one account reports 147 victims, while another reports 137 compromised hosts. The reason for the discrepancy is not known.

Domain-administrator access was confirmed at 12 organizations. That level of control enables account creation, policy modification, lateral movement, persistence, and access to systems throughout a Windows enterprise.

The campaign’s final objective remains undetermined. GreyNoise could not establish whether the actor intended to conduct subsequent operations directly or package the access for other criminal operators, such as initial access brokers.

The resulting access would support data theft or ransomware deployment, but neither outcome has been confirmed as the campaign’s ultimate purpose. Attribution also remains limited: the operational environment appeared Russian-speaking, but no specific organization has been conclusively identified.

Administrators Should Treat Exposed Servers as Potentially Compromised

PaperCut NG and MF administrators should upgrade immediately to version 24.1.9 or later and implement the vendor’s security recommendations. Internet-exposed installations require first priority.

Patching closes the vulnerabilities but does not remove credentials, accounts, or persistence created before the update. Organizations that operated an affected version should investigate the server and its associated domain controllers, especially if the PaperCut service had elevated domain privileges.

Response teams should look for:

• Access to LSASS memory or registry credential stores
• Pass-the-hash authentication against domain controllers
• Evidence of NoPac exploitation
• Unexpected local or domain account creation
• Unauthorized additions to the Domain Admins group
• DCSync requests from systems that are not domain controllers
• Access to or exfiltration of NTDS.DIT
• Unapproved tunnels or artifacts associated with Ligolo-ng
• Execution of Mimikatz, Certipy, Rubeus, Impacket, NetExec, or custom credential collectors

Credentials accessible to the PaperCut server should be rotated, with particular attention to service accounts and privileged domain identities. Administrators should also verify remediation for CVE-2021-42278 and CVE-2021-42287 across every relevant Windows Server system.

No campaign-specific network indicators, filenames, hashes, or command lines have been disclosed. Defenders must therefore rely on behavioral evidence, identity logs, endpoint telemetry, directory-service events, and forensic examination of affected PaperCut hosts.

The KEV Record Shows a Broader Patch-Management Problem

The two PaperCut flaws are not isolated additions to CISA’s exploited-vulnerability catalog. During the previous 90 days, six other Microsoft or PaperCut vulnerabilities entered KEV: CVE-2026-85880 and CVE-2026-81963 on 2026-09-08; CVE-2019-1068 on 2026-08-26; CVE-2026-33824 and CVE-2026-55040 on 2026-08-18; and CVE-2026-68820 on 2026-08-11.

This campaign also demonstrates how old identity-layer weaknesses can magnify a newly exploited application flaw. Even after PaperCut is updated, unpatched Active Directory systems can preserve an escalation route for attackers who already gained a foothold.

The operational change is speed. Hundreds of AI agents allowed one actor to perform tasks concurrently that would otherwise require a larger team and a longer development cycle. For exposed infrastructure, the useful remediation window may now be measured in minutes.