55
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
GreyNoise's Global Observation Grid observed a Russian-speaking threat actor operating from IP 45.142.193.132 deploy hundreds of autonomous AI agents, built on OpenAI's Codex harness with a DeepSeek model, to exploit PaperCut NG/MF flaws CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection RCE). At least 440 servers across 395 organizations in 48 countries were compromised; the US had 98 victims and educational institutions accounted for 204. The agents paired with Mimikatz, Certipy, Rubeus, and Impacket, escalated to domain admin in 12 of 440 cases, and executed DCSync to exfiltrate the full NTDS.DIT credential database.
78
60
30
60
30
42
30
42
30
55
30
30
60
57
60
55
55
42
60
60
60
30
Roundtables: Will AI really kill us all?
MIT Technology Review hosts a September 15 roundtable debating whether advanced AI poses genuine extinction risk or is hype.
MIT Technology Review will stream a live roundtable on Tuesday, September 15 at 16:00 BST, with executive editor Niall Firth, senior AI editor Will Douglas Heaven, and AI reporter Grace Huckins. The discussion examines AI extinction fears voiced by employees at leading AI labs, their origins, and whether the concerns are warranted. The session is an editorial debate rather than new research or a security incident.
25
Brand Impersonation Takedown: From Whack-a-Mole to Managed Response
Mandiant-tracked group UNC3753 impersonated US professional services firms' brands in 2026; Cyble urges managed takedowns over manual abuse reports.
Cyble describes how Google Mandiant-tracked group UNC3753 targeted US professional services firms between January and May 2026 using brand impersonation, spoofed domains, and fake executive profiles. Manual takedowns fail because phishing pages damage brands within hours while removal takes days. A managed takedown program with continuous monitoring and pre-authorized removal cuts the exposure window from days to hours.
50
Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware
Infoblox finds dropcatch expired domains fuel malware delivery and C2, with actor Sable Squirrel spending ~$7M on 10,000+ domains.
Infoblox Threat Intel reports that in H1 2026 dropcatch (re-registered expired) domains made up nearly 20% of all new registrations, about 65,000 per day, inheriting reputation and traffic that attackers exploit. Threat actor Sable Squirrel spent nearly $7 million on 10,000+ expired domains, running Vietnamese, Korean, Japanese and Australian streaming platforms (Xoilac, Cakhia, 90phut) that double as C2 servers for Quasar RAT, AsyncRAT, DCRat and Remcos RAT. Scavenger actors like Shady Squirrel acquire previously compromised domains and feed inherited traffic to SocGholish and tech support scam networks.
58
55
30
30
30
60
Week in review: GitHub breached via poisoned VS Code extension, critical NGINX flaw exploited
60
60
30
30
30
30
30
42
30