Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
GreyNoise tracked a likely Russian-speaking actor that used AI agents (OpenAI Codex, a DeepSeek model) to exploit an authentication bypass (CVE-2026-81578) and unsafe-reflection RCE (CVE-2026-82078) in PaperCut NG/MF starting August 31, 2026. At least 440 servers across 395 organizations in 48 countries were compromised, with one US high school going from initial access to Domain Admin in seven minutes. Escalation relied on LSASS and registry credential harvesting, pass-the-hash, the noPac technique (CVE-2021-42278/CVE-2021-42287), new Domain Admin accounts, and DCSync to steal NTDS.DIT data. Operators staged registry hives, used Ligolo tunneling and certutil Base64 encoding for exfiltration, and one attempt was blocked by Cloudflare WAF.
- 440 PaperCut NG/MF servers compromised across 395 organizations in 48 countries since August 31, 2026
- Actor validated exploits in a self-hosted lab and used OpenAI Codex plus DeepSeek to accelerate attack execution
- Domain Admin reached in only 12 victims, with fastest escalation in five minutes; noPac and DCSync used
- GreyNoise published IOCs including IPs 45.142.193.132 and 45.158.196.75, Rust LSA tools, and staged hive paths
- Defenders urged to patch PaperCut, review Domain Admin group changes, and monitor DCSync, LSASS and certutil activity
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-42287+1 related CVE | Privilege Escalation in Microsoft Active Directory Domain Services | 7.5 | 77% | KEVRansomware | KEV |
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | netlas.io | Cut software and an Active Directory server. They also used Netlas.io to compile lists of potential targets. After validating the |
| ipv4 | 45.142.193.132 | lowed by Base64 encoding using certutil Download URL hxxp://45.142.193[.]132:8000/lsa_collect.exe Download location for LSA bootkey co |
| ipv4 | 45.158.196.75 | paign orchestration and execution infrastructure IP address 45.158.196.75 Infrastructure used to execute campaign activity File hash |
| md5 | 528cd4e69ecfa5191adbcf6ef28667bf | Infrastructure used to execute campaign activity File hash 528cd4e69ecfa5191adbcf6ef28667bf lsa_read.exe — Rust LSA secret reader File hash ce870a91e8d |
| md5 | 974decb9ff4c8f9ccb0937c96d513347 | sa_collect_small.exe — Rust LSA bootkey collector File hash 974decb9ff4c8f9ccb0937c96d513347 certipy.exe — Active Directory Certificate Services abuse t |
| md5 | a6437ac3d6798090a218520985d36a3f | 687abc60b04 save_hives.exe — registry hive dumper File hash a6437ac3d6798090a218520985d36a3f collect_custom.exe — Rust custom collection tool File hash |
| md5 | ce870a91e8d27e8f663f0687abc60b04 | f6ef28667bf lsa_read.exe — Rust LSA secret reader File hash ce870a91e8d27e8f663f0687abc60b04 save_hives.exe — registry hive dumper File hash a6437ac3d67 |
| md5 | fc92dfafa7aa741c5f2b9cbcf75d1d19 | collect_custom.exe — Rust custom collection tool File hash fc92dfafa7aa741c5f2b9cbcf75d1d19 lsa_collect_small.exe — Rust LSA bootkey collector File has |
| url | http://45.142.193.132:8000/lsa_collect.exe | ing followed by Base64 encoding using certutil Download URL hxxp://45.142.193[.]132:8000/lsa_collect.exe Download location for LSA bootkey collector Download URL |
| url | http://45.142.193.132:8089/agent5.exe | xe Download location for LSA bootkey collector Download URL hxxp://45.142.193[.]132:8089/agent5.exe Ligolo-ng payload location File path C:\ProgramData\Legit |
From the original article
4 min read at gbhackers.com
Threat intelligence firm GreyNoise has identified an AI-driven intrusion campaign, likely orchestrated by a Russian-speaking threat actor, that compromised at least 440 PaperCut NG/MF servers across 395 organizations in 48 countries.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.