PaperCut Attack Used AI Agents to Breach 440+ Instances

A recently disclosed PaperCut vulnerability has been turned into an automated intrusion campaign that compromised at least 440 instances of the print management software across 48 countries, according to independent reports from Blackpoint Cyber and GreyNoise shared with The Hacker News. The activity is attributed to a suspected Russian-speaking cyber actor and was first flagged through an IP address, 45.142.193.132, that had been seen in unauthorized port scanning and brute-force attack attempts in recent weeks. Arctic Wolf also linked the same address to exploitation activity last week.

Nevan Beal, principal MDR analyst at Blackpoint, said the exact end goal of the campaign is not confirmed. The methodology is consistent with initial-access activity, but there is not yet enough evidence to confirm whether the actor is operating as an initial access broker. Initial access means the attacker gains a foothold in a network and may later sell that access to other criminals.

The campaign targets two vulnerabilities in PaperCut NG/MF: CVE-2026-81578 and CVE-2026-82078. Together they form an authentication bypass and remote code execution chain. In plain terms, authentication bypass lets an attacker get past a login screen without valid credentials, and remote code execution lets them run commands on the server. The attackers focused mainly on education sector organizations in the United States, the United Kingdom, France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland.

After breaking in, the attacker delivered tools to collect Windows registry hive data, Java payloads associated with Metasploit and Meterpreter, and commands used to identify hosts, users, processes, and sensitive configuration data. GreyNoise said it has tracked the malicious IP address since early July 2026, when it was already probing internet-facing systems from vendors including Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.

GreyNoise found that the adversary built and attacked a lab environment containing vulnerable PaperCut software and an Active Directory server. Active Directory is the directory service many organizations use to manage user accounts and permissions. The adversary also built target lists using the internet scanning service Netlas.io with an identified API key. After achieving remote code execution and credential harvesting in the lab, the attacker unleashed hundreds of AI agents powered by OpenAI Codex, a DeepSeek model, and publicly available offensive security tools including Mimikatz, SharpHound, Certipy, Rubeus, and Impacket. These agents then compromised at least 440 PaperCut MF/NG instances hosted by 395 identified victim organizations.

GreyNoise added that there are other real victims that could not be attributed to a named organization. The attacker explicitly tried to avoid targeting entities in 28 identified countries, including Russia, China, Hong Kong, Thailand, Iran, Venezuela, Indonesia, Pakistan, and Bangladesh, but the observed victimology shows that restraint failed in some cases.

The speed of the operation is striking. According to GreyNoise, the attacker progressed from an empty workspace to first achieving remote code execution against a real victim in just under four hours, and then compromised at least 11 organizations in 26 seconds once the campaign began in earnest. In one attack against a high school in the United States, the time between initial access and full domain administrator access was seven minutes. Domain administrator access means the attacker gained the highest level of control over the school's Windows network. In total, the adversary is said to have gained domain administrator access against only 12 victim organizations, and the end goals remain unclear.

Blackpoint Cyber shared additional details, saying it traced the activity to an exposed operator infrastructure that shows the AI-assisted workflow from vulnerability research and exploit development through to target filtering, failure analysis, code changes, and repeated retry waves. The earliest recovered activity began on August 31, with the project focused on vulnerability research and comparing patched and unpatched PaperCut builds. Within hours, that research had been turned into a multi-threaded validation tool that was reviewed, tested, and run against progressively larger target sets.

The use of AI extends to the targeting pipeline. Recovered source code acts as a funnel that merges multiple source lists, geolocates candidates, filters them by country, applies the exclusion policy, and identifies live PaperCut systems. In the final stage, targets are categorized by operating system and environment, and placed into separate lists for active, unreachable, missing specific stages, eligible for post-exploitation actions, and waiting for retry, rather than treating every unsuccessful attempt as the same problem. Python scripts keep track of later stages and verify completion, including administrator access, account verification, Active Directory collection, domain and network discovery, and proxy setup. Failures are recorded so the framework can adapt and move forward.

The project is best understood as a system where AI is the center around which the entire architecture revolves, turning vulnerability research into an exploitation pipeline through a persistent feedback loop. Two open-source tools support this: Hindsight, which provides persistent memory for AI agents, and AionUi, which gives a unified graphical workspace to run and view multiple AI agents at the same time. Blackpoint said the strongest AI impact was not a novel exploit technique, but the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems. The operator used an iterative development process in which AI-supported research, coding, testing, troubleshooting, and campaign execution continuously informed one another, and context was preserved as the project moved from vulnerability research to exploit validation, tooling development, target expansion, and operational execution.

For organizations running on-premises business software, a security-first IT and infrastructure review such as the one offered by AEU-I can help verify that internet-facing systems are patched, access is restricted, and monitoring is in place before attackers automate their way in.