Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script

REG AD

security

Human operator: don't touch CIS orgs. AI agents: look a squirrel! 

An unknown attacker used hundreds of AI agents to exploit two PaperCut MF/NG bugs and break into at least 395 organizations. The victims were concentrated in the US education sector, and the intrusions moved fast. In one case, an American high school went from initial access to domain admin in seven minutes.

These agents, powered by OpenAI’s Codex harness and a DeepSeek model, also allowed the miscreant to attack organizations at scale, according to threat-intel firm GreyNoise, which traced the campaign’s orchestration to 45.142.193.132 on August 31.

“The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds,” GreyNoise analysts said in a Wednesday report.

The security provider attributes these intrusions to a “likely Russian-speaking” criminal who used AI to develop exploits against the pair of PaperCut vulnerabilities disclosed just days earlier. 

On August 28, the print management software provider issued emergency patches for CVE-2026-81578 and CVE-2026-82078, at the time warning that it was “aware of confirmed customer incidents and are treating this matter with the highest priority.” The flaws affect PaperCut NG and MF, which are self-hosted Java web applications that by default run with SYSTEM-level privileges on Windows.

PaperCut’s CEO later said that the first reported compromise came in on August 27, and involved an education-sector firm.

On Thursday, PaperCut published security maintenance releases, which replace the earlier emergency fixes.

By now, however, at least 440 instances hosted by 395 identified victim organizations in 48 countries have been compromised, according to GreyNoise. “There are other real victims that could not be attributed to a named organization,” the threat signals team wrote.

The human attacker told the agents to avoid targeting entities in 28 countries with the top five being Russia, China, Hong Kong, Thailand, and Iran. Several Commonwealth of Independent States (CIS) countries are on the list, which is why GreyNoise says the crim is likely Russian-speaking. 

It’s typical for ransomware and other cybercrime operations to expressly avoid attacking Russia and other CIS countries, whose governments often provide safe harbor for extortionists and financially motivated crims - especially if they also happen to work day jobs as state-sponsored hackers. Plus, local cops tend to ignore the digital break-ins unless the gangs infect any in-country organizations.

However, the agents in the PaperCut attacks didn’t always follow these instructions, and in some cases still hacked organizations based in countries on the do-not-hit list. “It’s currently uncertain why the [attacker's] agents deviated,” GreyNoise said. “But it is a good example of agents gone wild.”

The US and the UK were the countries with the highest victim count, at 98 and 59, respectively. Schools and other education-industry organizations were, by far, the hardest hit with 204 victims. For comparison, the No. 2 industry (other/unclassified) had 51, while retail/commercial/professional services ranked third with 38 victims.

After using AI to develop exploits, achieve remote code execution, and harvest credentials in a self-hosted lab, the baddie set hundreds of AI agents loose on the open internet to find and attack public-facing, vulnerable instances. “This campaign appears to be opportunistic,” according to GreyNoise. “There is a high concentration of US-based targets in the education sector; however, it’s likely that is more attributable to the customer base of PaperCut NG/MF.”

Interestingly, the attacker did not immediately set to work on post-compromise evil deeds with all of the victims. GreyNoise noted “multiple-day delays” between gaining initial access and achieving domain admin “but only due to a lack of action by the adversary.” The fastest time was five minutes, while the longest was 144 minutes.

It’s also unclear if the criminal is only focused on gaining access to compromised organizations - and then plans to hand the attack off to affiliates or other data-theft, extortion, and ransomware groups - or if they plan to use this access for follow-on nefarious activities of their own.

GreyNoise does note that, in at least one case, Cloudflare’s Web Application Firewall (WAF) blocked the attacker. “Fundamental hardening of environments still matters against AI-enabled threats,” they wrote.

It’s also worth noting that GreyNoise has been tracking malicious use of 45.142.193.132 since early July, and says this IP has been used in attacks against internet facing technologies and devices from Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE. ®