PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances.

According to independent reports from Blackpoint Cyber and GreyNoise, the activity originates from "45.142.193[.]132," an IP address that has been linked to unauthorized port scanning and brute-force attack attempts in recent weeks. It's worth noting the same IP address was also flagged by Arctic Wolf in connection with the same activity last week.

At its core, the opportunistic attacks exploit CVE-2026-81578 and CVE-2026-82078, a combination of an authentication bypass and remote code execution chain, to mainly target the education sector in the U.S., the U.K., France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland.

"Observed post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitive configuration data," Arctic Wolf noted.

GreyNoise said it has been tracking the malicious use of the IP address since early July 2026 for probing internet-facing systems from vendors, including Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.

"As part of the adversary's exploit development and testing, they built and attacked a lab environment that included the vulnerable PaperCut software and an Active Directory server," the threat intelligence firm said. "In parallel workflows, the adversary built target lists using an internet scanning service Netlas.io using an identified API key."

Upon gaining remote code execution and credential harvesting within its self-hosted lab environment, the threat actor has been observed unleashing hundreds of AI Agents powered by OpenAI Codex, a DeepSeek model, and publicly available offensive security tools (e.g., Mimikatz, SharpHound, Certipy, Rubeus, and Impacket) to compromise no less than 440 instances of PaperCut MF/NG hosted by 395 identified victim organizations in 48 countries.

"There are other real victims that could not be attributed to a named organization," GreyNoise added. "The adversary did explicitly attempt to avoid targeting entities in 28 identified countries; however, our observed victimology shows the attempted restraint failed in some instances." Some of the countries added to the exclusion list include Russia, China, Hong Kong, Thailand, Iran, Venezuela, Indonesia, Pakistan, and Bangladesh.

The findings come at a time of considerable concern over how AI models are enabling bad actors to integrate agentic capabilities into various stages of an attack lifecycle, and help them accelerate and conduct attacks at scale.

According to GreyNoise, the attacker swiftly progressed from an empty workspace to first achieving remote code execution against a real victim in just under four hours, and compromised at least 11 organizations in 26 seconds once the campaign began in earnest. In one attack targeting a high school in the U.S., the duration between initial access and full domain administrator access was a mere seven minutes.

In all, the adversary is said to have gained domain administrator access against only 12 victim organizations. The attacker's end goals remain unclear at this stage.

"It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses to achieve follow-on objectives such as data theft or ransomware deployment," GreyNoise said.

More Details Emerge

Blackpoint, which shared additional details of the same activity, said it traced it back to an exposed operator infrastructure that depicts the AI-assisted workflow from vulnerability research and exploit development to execution through target filtering, failure analysis, code changes, and repeated retry waves.

"The earliest recovered activity began on August 31, with the project focused on vulnerability research and comparing patched and unpatched PaperCut builds," researchers Sam Decker and Nevan Beal said. "Within hours, that research had been turned into a multi-threaded validation tool that was reviewed, tested, and run against progressively larger target sets."

The threat actor's use of AI also extends to the targeting pipeline, with recovered source code acting as a funnel that merges multiple source lists, geolocating candidates and filtering them by country, applying the aforementioned exclusion policy, and identifying live PaperCut systems before moving to the next stage.

In the final stage, the targets are categorized by operating system and environment, as well as through separate lists for those that are active, unreachable, missing specific stages, eligible for post-exploitation actions, and waiting for a retry, as opposed to treating every unsuccessful attempt as the same problem.

Complementing these efforts are Python scripts that keep track of the later stages and ensure they have actually completed. These include tasks like administrator access, account verification, Active Directory collection, domain and network discovery, and proxy setup. Failures are recorded, allowing the attack framework to adapt its approach and move forward.

The project is best understood as one where AI is the fulcrum around which the entire system architecture revolves, transforming vulnerability research into an exploitation pipeline via a persistent feedback loop that informs every cycle. Supporting the system in this effort are two crucial open-source tools -

Hindsight, which provides a persistent memory service for AI agents AionUi, which provides a unified graphical workspace to run and view multiple AI agents concurrently

The campaign shows threat actors are using AI not just to assist with malware development, but also to troubleshoot failures, preserve project state, and augment other operational aspects, thereby bringing down the manual effort required to pull off such an attack. These changes have a significant impact on the economics of cyber attacks, according to the cybersecurity company.

"The strongest AI impact in this campaign was not a novel exploit technique," Blackpoint said. "It was the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems."

"The operator was using an iterative development process in which AI-supported research, coding, testing, troubleshooting, and campaign execution continuously informed one another. Context was preserved as the project moved from vulnerability research to exploit validation, tooling development, target expansion, and eventually operational execution."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.