Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide
Attackers used Codex and DeepSeek agents to exploit PaperCut flaws and compromise 440 servers in 48 countries.
7
Stories per day · 30 days
3 RSS
Relatedd-link4proxyjacking4pawns.app3ubiquiti3edge-devices2log4shell2residential-proxy2sap2sap-netweaver2ai-agents1codex1cve-2026-815781cve-2026-820781deepseek1exploitation1papercut1pawns-app1skynox71
25 stories, newest first · one card per story
Stories tagged #greynoise
Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks
Actor skynox7 exploited D-Link, Ubiquiti, and SAP flaws to proxyjack 143 devices.
New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.
3
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
GreyNoise found attackers exploiting edge-device flaws in 34 countries to install Pawns.app and resell bandwidth.
5
skynox7: Proxyjacking Edge Devices Into Residential Proxies
An actor exploited edge-device flaws to install Pawns.app, compromising at least 143 devices in 34 countries.
10
Hackers Target Hikvision Cameras in Ukraine With RCE Exploits Amid Russian Airstrikes
GreyNoise saw exploitation attempts against Ukrainian Hikvision cameras using CVE-2021-36260, with no confirmed strike link.
10
Hikvision Camera Vulnerability Targeted in Remote Code Execution Exploitation Attempts
GreyNoise saw exploitation attempts against Hikvision CVE-2021-36260 aimed at Ukraine, without confirmed device takeovers.
14
Spike in Attacks Targeting Digital Video Recorders in Ukraine
GreyNoise recorded a nine-day surge of CVE-2021-36260 exploitation attempts against Hikvision devices in Ukraine.
16
Swarming Against Citrix 0-Day Exploitation
GreyNoise saw pre-disclosure exploitation of Citrix NetScaler CVE-2026-88771 three days before public disclosure.
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-linked actor exploited WordPress and Zyxel flaws, stealing government records from dozens of organizations.
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
Chinese hackers exploited ZyXEL CVE-2026-7273 on GS1900 switches in 48 countries; CISA added it to KEV.
3
CISA orders feds to patch Zyxel flaw exploited for data theft
CISA added actively exploited Zyxel GS1900 flaw CVE-2026-7273 to KEV, ordering federal agencies to patch by Thursday after ~1,000 switches were compromised.
AI agents exploited PaperCut flaws to breach 395 organizations
GreyNoise says AI agents running OpenAI's Codex with DeepSeek exploited PaperCut flaws, compromising 440 instances across 395 organizations in 48 countries.
3
PaperCut Flaws Exploited in AI-Powered Attacks
GreyNoise says a Russian-speaking actor used AI to build and deploy exploits hitting 440 PaperCut NG/MF deployments across 395 organizations in 48 countries.
2
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut shipped maintenance releases replacing emergency patches for two actively exploited flaws abused in AI-assisted attacks on 395 organizations.
3
Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
4
AI-powered attack exploited PaperCut flaws to hack 395 organizations
AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.
3
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
2
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
5
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.
4
GreyNoise + CrowdStrike: Real-Time Edge Intelligence in Falcon Next-Gen SIEM and Charlotte Agentic SOAR
GreyNoise expanded its CrowdStrike Falcon integration with Next-Gen SIEM dashboards, correlation rules, and Charlotte Agentic SOAR playbooks.
Threat actors are posing as AI crawlers to hunt for exposed credentials
GreyNoise observed scanners spoofing AI crawler user agents from 824 IPs to harvest .env files and cloud credentials; no confirmed theft.
3
.png&w=828&q=75)
Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets
GreyNoise observes scanners spoofing OpenAI, Anthropic, and DeepSeek crawler user agents to hunt leaked credentials and secrets.
3
A New Way to Navigate GreyNoise
GreyNoise launched a redesigned Visualizer that consolidates internet-noise analysis workflows into one interface.