Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers

Threat intelligence firm GreyNoise has identified an AI-driven intrusion campaign, likely orchestrated by a Russian-speaking threat actor, that compromised at least 440 PaperCut NG/MF servers across 395 organizations in 48 countries.

This campaign began on August 31, 2026, exploiting two vulnerabilities in PaperCut: CVE-2026-81578, an authentication bypass flaw, and CVE-2026-82078, a vulnerability that allows unsafe reflection of remote code execution.

The actors utilized infrastructure, including the IP address 45.142.193.132, which GreyNoise had tracked since early July for attacks against internet-facing systems from Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.

Hackers Deploy AI Agents

PaperCut NG and MF are attractive targets because they are commonly used domain-joined Java web applications that run with SYSTEM-level privileges on Windows.

In enterprise environments, these applications are often integrated with Active Directory, which could provide a pathway from a print management server to a broader domain compromise.

According to GreyNoise, the threat actor developed and tested exploits in a self-hosted lab that included vulnerable PaperCut software and an Active Directory server.

They also used Netlas.io to compile lists of potential targets. After validating their remote code execution and credential-harvesting techniques, the actor launched a global campaign using OpenAI Codex, a DeepSeek model, and publicly available offensive security tools.

The operation showed that agentic workflows can significantly accelerate attack execution. GreyNoise reported that the actor moved from an empty workspace to achieving remote code execution against a legitimate victim in less than four hours.

They reportedly escalated privileges to Domain Admin level two hours later. At their peak, the campaign compromised at least 11 organizations in just 26 seconds. One U.S. high school reportedly moved from initial access to full domain administrator compromise in just seven minutes.

However, the campaign’s success was inconsistent. While at least 440 PaperCut instances were compromised, GreyNoise observed that Domain Admin privileges were only obtained in 12 victim organizations.

The fastest escalation occurred in five minutes, while the longest took up to 144 minutes. In some instances, adversary actions stalled because operators did not proceed with post-exploitation activities promptly. Additionally, GreyNoise noted at least one attempt that Cloudflare’s Web Application Firewall thwarted.

Where the actor achieved Domain Admin access, it used three primary methods. They harvested LSASS process memory and registry secrets from domain-joined PaperCut servers to recover privileged credentials and conducted pass-the-hash attacks.

For organizations that had not patched for CVE-2021-42278 and CVE-2021-42287, they used the noPac privilege escalation technique. In other scenarios, particularly when PaperCut ran on a domain controller or under a Domain Admin service account, the attackers created a new account. They added it to the Domain Admins group.

Overall, the attackers utilized DCSync to obtain NTDS.DIT data, enabling them to steal Active Directory credential information. GreyNoise indicated that it remains unclear whether the campaign’s objective is focused solely on access brokering or if the actor intends to engage in data theft, extortion, or ransomware attacks directly.

Organizations are advised to immediately patch any affected PaperCut deployments, restrict administrative exposure, review changes to the Domain Admin group, investigate staged registry hives and Ligolo artifacts, and monitor for DCSync, LSASS access, suspicious registry save, and certutil activity.

IoC

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.