Education Networks Face Credential Theft Through PaperCut Exploit Chain

Attackers are actively exploiting two newly disclosed PaperCut vulnerabilities to steal credentials from schools and universities in the United States and Europe, according to the Arctic Wolf Adversary Research Team. The security company observed exploitation of CVE-2026-81578 and CVE-2026-82078, an authentication bypass and remote code execution chain that allows an attacker to skip normal login checks and then run their own commands on a server. PaperCut is print management software used by many educational institutions and businesses to control printing, copying and scanning.

Arctic Wolf told The Hacker News that the attacks have targeted vulnerable PaperCut servers across the education sector, from K-12 schools to major universities. Once inside, attackers ran discovery commands such as uname, whoami, ver and tasklist to learn the host name, current user, operating system version and running processes. They also created a privileged account called Administrator17. Post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitive configuration data.

To harvest credentials, the attackers delivered tools named lsa_collect.exe, lsa_collect_small.exe and save_hives.exe using the legitimate Windows utility certutil.exe. These tools collect data from the Windows registry, a database that stores system and user settings. In a sandbox, Arctic Wolf observed lsa_collect.exe extracting specific registry keys to reconstruct the system BootKey, a secret value that can unlock the Security Account Manager (SAM) database where Windows stores password hashes. If attackers recover those hashes, they can try to crack them or reuse them to access other systems that share the same passwords. Arctic Wolf said the concern is that stolen logins could give attackers a pathway into other critical systems across the environment.

Arctic Wolf listed several indicators of compromise. Inbound GET requests from IP address 45.142.193[.]132 asked for files named /custom/pcp_*.txt and /custom/web/pcp_*.txt on compromised hosts, which contained harvested system and user data. The same address delivered the credential-harvesting tools, while a second address, 194.180.48[.]134, served Meterpreter (a remote control tool used by attackers) Java payloads and accepted sessions from infected machines. The attackers also used the findstr command to search PaperCut configuration files for the terms password, secret, ldap, bind and token, likely looking for stored passwords or service account details.

Defenders should restrict PaperCut servers from being exposed to the internet and monitor for execution of cmd.exe, powershell.exe or other scripting and command interpreters (programs that let someone type commands directly), especially when the parent process is pc-app.exe, the PaperCut application. Commands containing whoami, tasklist, ver or uname -a are worth reviewing. For organizations that run PaperCut or similar internet-facing server software, working with a security-focused IT infrastructure partner such as AEU-I can help harden deployments and monitor for suspicious command execution and account changes.