PaperCut NG/MF servers mass-exploited in a campaign GreyNoise says was run by AI agents
Summary
On Sep 9, 2026, GreyNoise and Blackpoint Cyber separately reported a campaign that used two PaperCut NG/MF flaws, CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection leading to code execution), against internet-facing print management servers. GreyNoise says a likely Russian-speaking actor compromised at least 440 PaperCut instances at 395 identified organizations in 48 countries, harvested credentials from 280 instances, took OS or domain secrets from 147 and reached domain admin at 12 organizations. GreyNoise reports that the actor used hundreds of AI agents running on OpenAI's Codex harness with a DeepSeek model, not OpenAI models. That harness detail is GreyNoise's finding alone: Blackpoint, working from the actor's exposed directory, confirms an AI-assisted, agent-style workflow but does not name the harness or the model, and we found no comment from OpenAI. GreyNoise dates the attacks from Aug 31, after PaperCut's Aug 27 advisory; the Cloud Security Alliance described the flaws as zero-days. This is misuse of AI tools by an attacker, not a flaw in Codex or DeepSeek. Backfill of a September campaign that is recirculating.
Severity
Timeline
PaperCut publishes an urgent security bulletin on active exploitation of PaperCut NG/MF; emergency patches follow (Release 2 on Aug 28, Release 3 on Sep 1).
GreyNoise says the actor downloads the advisory and patched and unpatched builds, diffs them, builds a lab and gets code execution on a first real target in Australia in just under four hours.
GreyNoise says the agents launch the main campaign, compromising 11 organizations in 26 seconds.
GreyNoise records the last remote code execution of the campaign.
GreyNoise and Blackpoint Cyber publish their reports.
PaperCut publishes maintenance releases 26.0.5, 25.0.13 and 24.1.10, replacing all emergency patches.
The Cloud Security Alliance publishes a research note on the campaign, describing the flaws as zero-days.
How it happened
CVE-2026-81578 lets an unauthenticated request change PaperCut configuration; CVE-2026-82078 lets a configured database driver name load arbitrary Java classes. Chained, they give pre-authentication code execution as the PaperCut service, which by default runs as SYSTEM on Windows and is often domain-joined (per GreyNoise and PaperCut). GreyNoise, which watched the actor's infrastructure at 45.142.193.132, says the actor's agents downloaded PaperCut's advisory and both builds, diffed them, built a lab with an Active Directory server, wrote and refined a multi-threaded exploitation tool, sourced targets from Netlas.io, and then ran the campaign from a second host. GreyNoise reports first domain admin about two hours after first code execution, and in one case seven minutes from initial access to domain admin at a US high school. Where domain admin was reached, GreyNoise saw three paths: LSASS and registry secret dumping then pass-the-hash, the noPac attack on domains unpatched for CVE-2021-42278 and CVE-2021-42287, or simply adding a new account to Domain Admins when PaperCut ran on a domain controller or as a domain admin. Each ended in a DCSync dump of NTDS.DIT. The agents were told to skip 28 countries but still hit some of them, which GreyNoise calls 'Agents Gone Wild'. A Cloudflare WAF stopped them on at least one target. Blackpoint traced the same IP to an open web directory holding the operator's project: timestamped state files written as an assistant working for a 'user', retry loops of up to 200 threads and 100 rounds, failure classification, and references to Hindsight (agent memory) and AionUI (agent orchestration). Blackpoint says nothing shows fully autonomous exploitation; the AI reduced the human effort of building, debugging and retrying at scale.
How to check your app
- Patch: move PaperCut NG/MF to 26.0.5, 25.0.13 or 24.1.10 or later, the maintenance releases named in PaperCut's advisory (they replace all emergency patches; PaperCut's upgrade page now also lists 24.1.11). Versions 23 and earlier get no fix; upgrade to a supported line. Update Site Servers and secondary servers too.
- Until patched, make the Application Server's web interface reachable only from trusted addresses.
- Search server.log for PaperCut's published strings, including 'No suitable driver found for jdbc:no:x', 'DB URL: jdbc:derby:memory:pwn;create=true' and 'Database error looking up cardID: VALUES CAST', and look for unexpected .class files in server\lib and .cmd/.out files in server\data\content. Missing or truncated logs are also a warning sign.
- Check GreyNoise's indicators: traffic to or from 45.142.193.132 and 45.158.196.75, an account named Administrator17, hive files like C:\Windows\Temp\pc-*.hiv and pc-*.b64, pcp_*.txt files under PaperCut's server\custom\web folder, and Ligolo agents such as C:\ProgramData\ligolo-agent.exe or C:\ProgramData\LegitSvc\legit-svc.exe. Blackpoint publishes file hashes and reverse SOCKS listeners on TCP 31337 and nearby ports.
- Hunt for pc-app.exe spawning cmd.exe, powershell.exe, whoami, nltest, reg or similar, and for changes to the user-lookup.db-driver and user-lookup.db-url settings (per Blackpoint).
- If compromised, treat it as a domain incident: PaperCut advises wiping and rebuilding the server from a clean backup, and GreyNoise's attack paths mean domain credentials, LSA secrets and PaperCut's stored LDAP and database credentials should be rotated.
Sources
- GreyNoise: Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF (Sep 9, 2026)
- Blackpoint Cyber: Death by a Thousand PaperCuts: AI-Driven Exploitation at Scale (Sep 9, 2026)
- PaperCut: URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)
- Cloud Security Alliance: AI Agent Swarm Exploits Patched PaperCut Flaws in 395 Breaches (research note, Sep 2026)