PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
A suspected Russian-speaking actor exploited the CVE-2026-81578 authentication bypass and CVE-2026-82078 RCE chain in PaperCut NG/MF, compromising at least 440 instances across 395 organizations in 48 countries, heavily targeting education in the US, UK, France, and elsewhere. The actor used hundreds of AI agents powered by OpenAI Codex and DeepSeek plus tools like Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, reaching domain admin at 12 victims and full domain admin at a US high school within seven minutes. Post-exploitation included registry hive collection and Metasploit/Meterpreter payloads, with origin traced to IP 45.142.193.132.
- Exploits CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF
- 440+ instances compromised across 395 organizations in 48 countries
- Hundreds of AI agents (OpenAI Codex, DeepSeek) drove the exploit pipeline
- Attack framework used Hindsight memory and AionUi workspace
- Post-exploitation used Mimikatz, SharpHound, Certipy, Rubeus, Impacket
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1003.001 LSASS MemoryT1003.002 Security Account ManagerT1087 Account Discovery
- Victims
- US high school
- Organizations
- GreyNoiseBlackpoint CyberArctic Wolf
- AI models
- OpenAI CodexDeepSeek
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
4 min read at thehackernews.com
A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and GreyNoise, the activity originates from "45. 142.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.