PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
76
Victim
US high school
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 9, 2026
- Last mentionedSep 10, 2026
Timeline
2 articles · newest firstHackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
78
Related CVEs
by mentions- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2021-4228777%7.5Privilege Escalation in Microsoft Active Directory Domain Services
- CVE-2021-4227873%7.5Privilege Escalation via sAMAccountName Spoofing in Microsoft Active Directory
Appears with
- Certipyproduct · 2
- DeepSeekai model · 2
- Mimikatzproduct · 2
- PaperCutvendor · 2
- Impacketproduct · 2
- DeepSeekvendor · 2
- OpenAIvendor · 2
- GreyNoiseorganization · 2
- Rubeusproduct · 2
- Cloudflarevendor · 1
- SharpHoundproduct · 1
- Blackpoint Cyberorganization · 1
- Arctic Wolforganization · 1
- OpenAI Codexai model · 1
- PaperCut NGproduct · 1
- PaperCut NG/MFproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.