AI-powered attack exploited PaperCut flaws to hack 395 organizations
AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.
GreyNoise reports a likely Russian-speaking threat actor used hundreds of AI agents combining OpenAI Codex and DeepSeek models to build, test, and refine exploits for CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF, launching the campaign on August 31. At least 440 PaperCut instances at 395 organizations across 48 countries were compromised, with the education sector accounting for roughly half of victims and the US most targeted. Attackers harvested credentials from 280 victims, obtained OS or domain secrets from 147, and gained admin privileges at 12 organizations, using LSASS dumping, pass-the-hash, noPac, and DCSync to dump NTDS.DIT. The adversary went from empty workspace to first RCE in under four hours, and compromised at least 11 organizations within 26 seconds once the campaign launched.
- AI agents built, tested, and refined exploits for two actively exploited PaperCut flaws
- 440 PaperCut instances at 395 organizations in 48 countries were compromised
- Education sector made up roughly half of victims; US was most targeted
- Attackers used DCSync, pass-the-hash, and noPac paths to obtain domain credentials
- Empty workspace to first RCE in under four hours; 11 orgs hit in 26 seconds
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1003.001 LSASS MemoryT1550.002 Pass the HashT1003.006 DCSyncT1003.003 NTDS
- Products
- PaperCut NGPaperCut MF
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-42287+1 related CVE | Privilege Escalation in Microsoft Active Directory Domain Services | 7.5 | 77% | KEVRansomware | KEV |
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 61% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
A threat actor, likely Russian-speaking, used hundreds of AI agents to develop and launch a global exploitation campaign targeting vulnerable PaperCut NG/MF servers. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.