Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
GreyNoise's Global Observation Grid observed a Russian-speaking threat actor operating from IP 45.142.193.132 deploy hundreds of autonomous AI agents, built on OpenAI's Codex harness with a DeepSeek model, to exploit PaperCut NG/MF flaws CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection RCE). At least 440 servers across 395 organizations in 48 countries were compromised; the US had 98 victims and educational institutions accounted for 204. The agents paired with Mimikatz, Certipy, Rubeus, and Impacket, escalated to domain admin in 12 of 440 cases, and executed DCSync to exfiltrate the full NTDS.DIT credential database.
- Codex/DeepSeek-powered agents compromised 11 organizations in 26 seconds
- Actor rehearsed exploits in a private lab and built targets via a compromised Netlas.io API key
- Three paths: LSASS/registry credential theft, noPac CVE-2021-42278/42287, rogue Domain Admin accounts
- Agents told to avoid 28 countries still hit some, called 'agents gone wild'
- Past PaperCut exploitation led to ransomware; current intent remains unclear
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-42287 +1 in the same advisory: …42278 | Privilege Escalation in Microsoft Active Directory Domain Services CVE-2021-42287 is an elevation-of-privilege vulnerability in Microsoft Active Directory Domain Services (AD DS) affecting multiple supported Windows Server releases. An attacker with any low-privileged domain account can trigger it — commonly in combination with the related sAMAccountName spoofing flaw CVE-2021-42278 — by manipulating account name attributes so the Kerberos Key Distribution Center issues tickets that grant rights normally reserved for domain controllers. The result is escalation from a standard user to domain administrator, giving the attacker full control over the Windows domain, a capability that is directly useful for ransomware deployment and data theft. Any organization running Active Directory on the affected Windows Server versions is exposed, which amounts to essentially every enterprise Windows network. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 with known ransomware use, and EPSS assigns it a 77.2% probability of exploitation within 30 days. Do: Apply Microsoft's security updates to every domain controller — writable and read-only — as soon as possible (the fix shipped in Microsoft's November 2021 security releases), prioritizing internet-exposed and VPN-facing DCs. Hunt domain controller logs for anomalous Kerberos TGT requests by user accounts with domain-controller-style names (a hallmark of CVE-2021-42278/42287 abuse) and monitor for ransomware staging activity, given documented ransomware use. | 7.5 | 77% | KEV ransomware |
| masswell over 100,000 Windows Server domain controllers and millions of domain users worldwide | |
| CVE-2026-82078 +1 in the same advisory: …81578 | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile). Do: Upgrade PaperCut NG and MF to the patched release specified in PaperCut's security advisory (exact fixed versions were not provided in this data), prioritizing internet-exposed print servers; the KEV listing means agencies must remediate per CISA BOD 26-04 or discontinue/mitigate per its cloud-service guidance. Restrict the PaperCut web interface from direct internet exposure (VPN/allowlist), review administrator accounts and database driver configuration for tampering, and hunt for post-exploitation activity, since this flaw is being actively chained with the authentication bypass CVE-2026-81578. | 9.4 group max | 2% | KEV |
| mass≈100,000+ organizations / plausibly millions of end users (vendor-cited install base); tens of thousands of on-prem servers with a smaller but significant… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 45.142.193.132 | nfrastructure. The malicious actor operated from IP address 45.142.193.132, which GreyNoise had flagged since early July 2026 for prob |
Full article610 words · extracted from cybersecuritynews.com · click to collapse
A Russian-speaking threat actor has weaponized artificial intelligence at an unprecedented scale, deploying hundreds of autonomous AI agents to exploit critical vulnerabilities in PaperCut NG/MF print management software and compromise at least 440 servers across 395 organizations in 48 countries.
Security researchers at GreyNoise identified the campaign through their Global Observation Grid, a network of sensors that captures live attacker activity on controlled infrastructure.
The malicious actor operated from IP address 45.142.193.132, which GreyNoise had flagged since early July 2026 for probing internet-facing systems from vendors including Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.
On August 31, 2026, this infrastructure pivoted toward two PaperCut vulnerabilities, CVE-2026-81578 and CVE-2026-82078, an authentication bypass and an unsafe reflection remote code execution flaw, respectively.
PaperCut Flaws Compromised Using AI
PaperCut NG/MF is widely deployed self-hosted print management software that typically runs with SYSTEM-level privileges on Windows and integrates directly with Active Directory, making it an attractive foothold for lateral movement inside enterprise networks.
The attacker first built a private lab environment mirroring a vulnerable PaperCut deployment alongside an Active Directory server to develop and test exploits before going live. The attacker compiled target lists using the internet scanning service Netlas.io through a compromised API key.
Once the actor validated remote code execution and credential harvesting, they unleashed hundreds of AI agents built on OpenAI’s Codex harness paired with a DeepSeek model, combined with publicly available offensive tools such as Mimikatz, Certipy, Rubeus, and Impacket.
The speed was impressive. The attacker went from an empty workspace to executing code on a real target in under four hours. They gained domain administrator access two hours later.
Once the automated campaign launched fully, the AI agents compromised 11 organizations in just 26 seconds, and in one case breached a U.S. high school network from initial access to full domain admin in seven minutes.
Despite the scale, results varied significantly. Domain administrator access was confirmed in only 12 of 440 compromised instances, with successful escalations ranging from five to 144 minutes.
GreyNoise documented three distinct attack paths: harvesting LSASS memory and registry secrets for pass-the-hash attacks, exploiting unpatched “noPac” vulnerabilities CVE-2021-42278 and CVE-2021-42287, and directly adding rogue accounts to Domain Admins when PaperCut ran on a domain controller.
In every successful case, the actor executed DCSync operations to exfiltrate the full NTDS.DIT credential database.
Notably, the actor’s agents had been instructed to avoid targeting 28 countries including Russia, China, and Iran, yet victims were still recorded in several of these regions, an anomaly researchers describe as “agents gone wild,” highlighting how autonomous AI operations can deviate from operator intent.
In at least one attempted intrusion, Cloudflare’s Web Application Firewall successfully blocked the exploitation attempt, underscoring that fundamental security hardening remains effective even against AI-driven threats.
The United States accounted for the largest share of victims at 98, followed by the United Kingdom, France, and Spain, with educational institutions representing 204 of the 440 compromised systems, likely reflecting PaperCut’s strong customer base in that sector.
It remains unclear whether the actor intends to sell access to affiliated ransomware groups or pursue direct extortion, though past PaperCut exploitation has historically led to ransomware deployment.
GreyNoise says it is coordinating with incident response partners to notify affected organizations and continues to publish fresh indicators of compromise on its public GitHub repository.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/papercut-flaws-compromised-using-ai/