Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide

A cybercrime campaign used hundreds of AI agents to target internet-facing PaperCut NG and MF print-management servers, compromising at least 440 instances linked to 395 organizations in 48 countries, according to GreyNoise.

The operation paired OpenAI’s Codex coding-agent harness with a DeepSeek model and common security tools, allowing the operator to develop and test exploits before running them against exposed systems at scale.

The incident shows how AI agents can help an operator move quickly through a complex intrusion, but the breach still depended on vulnerable or poorly protected systems. Researchers found that compromised print servers were used to collect credentials and reach internal networks.

In a later investigation, analysts at Hunt.io identified exposed attacker directories containing agent instructions, exploit code, logs, credential tools, and files that documented how the operation developed.

The campaign centered on two PaperCut NG/MF vulnerabilities: CVE-2026-81578, which can allow unauthenticated requests to change certain settings, and CVE-2026-82078, an unsafe class-loading flaw that can enable code execution when an attacker can alter those settings.

Hackers Use Codex and DeepSeek AI Agents

The issues can work together to give an attacker a path from a vulnerable server to remote code execution. PaperCut says its current security maintenance releases are versions 26.0.5, 25.0.13, and 24.1.10; organizations should check the vendor’s advisory for supported upgrade guidance.

GreyNoise reported that the activity began on August 31, 2026, when the actor used a self-hosted lab to test the software and refine its exploit.

The campaign then moved from testing to real targets. GreyNoise said the operator reached a first real system in under four hours, gained domain administrator access two hours later, and compromised 11 organizations in 26 seconds once the wider operation began.

Those figures describe observed activity, not a guarantee that every target was fully breached or that every compromise led to the same result.

Cyber Security News previously reported that hundreds of AI agents targeted PaperCut flaws, with the campaign’s scale tied to automation and rapid exploitation.

Hunt.io’s later review adds detail from the operator’s own exposed workbench: it found structured project folders, status notes, target lists, and instructions that directed the coding agent to keep testing, change approach after failures, and work on multiple tasks in parallel.

The files indicate an automated and iterative process, rather than a single exploit run. The attacker’s tooling first checked whether a server appeared vulnerable, then changed PaperCut lookup settings to prepare a route to code execution.

Hunt.io found several exploit variants designed for different PaperCut versions and network conditions. It also found notes describing a separate XML-RPC route that could be used when the API was reachable but its access controls were weak.

This second path matters because patching the original vulnerability does not, by itself, secure an API that remains exposed with weak authentication or network restrictions.

After initial access, the operation moved beyond the print server. The exposed files showed tools for collecting Windows registry data and service credentials, along with scripts that could create reverse SOCKS tunnels.

Such tunnels allow an attacker to route traffic through a compromised host and reach systems inside the victim’s network. The files also recorded efforts to automate follow-up activity and package information about compromised systems for later access.

A related Cyber Security News report describes how a PaperCut foothold can become a route toward a domain controller and sensitive account data.

Hunt.io’s recovered material listed 1,005 hosts in the actor’s reconnaissance pool across at least 45 countries, including systems judged vulnerable and others marked as likely vulnerable based on version checks.

That figure is not the same as the 440 compromised instances reported by GreyNoise. Hunt.io also found 45 targets with working reverse SOCKS access at the time of capture and 46 Active Directory domains in the recovered victim packages.

Initial access

These records show how attackers can turn initial access into a longer-term network foothold, while also underscoring that each count comes from a different dataset and measure.

For defenders, the practical response is to patch and investigate. PaperCut recommends upgrading to its security maintenance releases and reviewing its advisory for the correct process.

Organizations should also limit public access to PaperCut management interfaces, restrict the XML-RPC API or enforce strong authentication and network allowlists, and review logs and endpoint alerts for suspicious activity.

Hunt.io recommends checking for unexpected changes to user-lookup.* settings, files written under PaperCut’s custom/web/ directory, unusual child processes, and signs of chisel-based tunnels or cron persistence.

The urgency extends beyond confirming that a server is now patched: a fix prevents further use of the known flaws, but it cannot establish whether an intruder already gained access.

Administrators should look for unexpected accounts, privilege changes, credential collection, unusual outbound connections, and signs of access to Active Directory.

The PaperCut command-execution coverage and a separate report on a PaperCut server used to reach a domain controller offer additional context for reviewing post-exploitation activity.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.