Hundreds of AI Agents Hit 440+ PaperCut Instances

Hundreds of AI Agents Hit 440+ PaperCut Instances

This campaign is more than another internet-facing exploit story.

GreyNoise tracked an operation in which a likely Russian-speaking malicious actor used hundreds of AI agents to develop, test, and deploy exploits against PaperCut NG/MF.

At least 440 PaperCut instances across 395 identified organizations in 48 countries were compromised. GreyNoise observed credential harvesting at scale and domain-administrator access at 12 organizations.

Malaysia was among the affected countries, with five victims recorded by GreyNoise.

What makes this incident interesting is not that an AI discovered some magical new exploit.

It is what happened after the exploit worked.

The attacker turned vulnerability exploitation into an operational pipeline: build the target list, test reachability, exploit the host, classify failures, retry, harvest credentials, and move deeper into the environment.

AI became part of the machinery that kept that loop running.

The two CVEs behind the campaign

PaperCut NG and MF are self-hosted Java web applications. On Windows, they normally run with SYSTEM-level privileges and are commonly integrated with Active Directory. That combination makes a compromised PaperCut Application Server particularly valuable to an attacker.

The campaign exploited two vulnerabilities:

• CVE-2026-81578 — an improper access-control vulnerability in the PaperCut web management interface.
• CVE-2026-82078 — an unsafe dynamic class-loading vulnerability associated with the external card/ID database lookup functionality.

PaperCut's own security log lists both vulnerabilities in its 27 August 2026 advisory.

Rapid7 reported that the two vulnerabilities could be chained to achieve remote code execution against affected PaperCut Application Servers.

GreyNoise observed the actor developing and testing the exploit chain in a dedicated lab containing vulnerable PaperCut software and an Active Directory server before moving to real-world targets.

PaperCut has already moved beyond the emergency patches

This is important because the original emergency-patch guidance is now outdated.

PaperCut's security bulletin was updated on 10 September 2026 with new maintenance releases:

• PaperCut NG/MF 26.0.5
• PaperCut NG/MF 25.0.13
• PaperCut NG/MF 24.1.10

PaperCut says these regular maintenance releases contain the security fixes from Emergency Patch Releases 1, 2 and 3, plus additional security hardening and full QA testing. They replace the emergency patches.

If you are still running one of the emergency-patch builds, PaperCut recommends moving to the corresponding maintenance release.

If you have not patched at all, upgrade now.

PaperCut also says that publicly reachable, unpatched Application Servers continue to be targeted.

For versions 23 and earlier, PaperCut says there are no emergency or maintenance releases for those old version lines. Organisations on those versions need to upgrade to a currently supported version line, or at minimum restrict Application Server access to trusted addresses while preparing the upgrade.

440 victims across 48 countries

GreyNoise's victimology gives the campaign some scale:

Education was the largest affected sector, accounting for 204 victims.

The United States had 98 victims, followed by the United Kingdom with 59. France and Spain each recorded 31, while Canada recorded 24.

Malaysia also appears in the victimology:

• 5 victims
• 4 credential-harvesting incidents
• 3 OS/domain-secret theft incidents

These are GreyNoise observations, not an estimate based on the number of exposed PaperCut servers.

The interesting part is the pipeline, not the exploit

GreyNoise had been tracking the infrastructure at 45.142.193.132 since early July 2026.

The infrastructure had previously been associated with attacks against internet-facing technologies from vendors including Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.

On 31 August, the activity shifted to PaperCut.

GreyNoise found evidence that the actor built a dedicated lab containing vulnerable PaperCut software and Active Directory. Target lists were then generated using an internet-scanning service and filtered before exploitation.

Once the exploit and credential-harvesting workflow worked in the lab, the attacker moved to real targets.

This is where the AI architecture becomes important.

GreyNoise says the campaign used hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model.

The model was therefore not an OpenAI model. OpenAI's Codex was used as the agent harness, while DeepSeek provided the model.

That distinction matters.

When people say "AI-powered attack", they often imagine one model receiving a prompt and doing everything.

This campaign was closer to:

model + agent harness + tools + state + target lists + retry logic + infrastructure.

That combination is much more interesting — and much more realistic.

The speed is the worrying part

GreyNoise observed several stages of the operation happening unusually quickly.

The actor reportedly went from an empty workspace to successful remote code execution against a real victim in less than four hours.

The first observed domain-admin compromise followed roughly two hours later.

Once the campaign was running, GreyNoise observed at least 11 organizations compromised within 26 seconds.

One U.S. high school went from initial access to domain administrator in approximately seven minutes.

That does not mean every target was compromised that quickly.

It means the automated workflow was capable of moving extremely fast when the conditions were right.

And that distinction matters.

AI agents are not magic buttons that make every exploit succeed.

Their advantage here was throughput.

When one target failed, the system could classify the failure and move on. When another target required a different path, the workflow could adapt.

The attacker did not need every attempt to work.

They only needed enough attempts to work.

Three paths to domain administrator

For organizations where the attacker reached domain-level control, GreyNoise identified three observed paths.

1. Credential harvesting

On domain-joined PaperCut servers, the attacker harvested credentials from LSASS memory and registry secrets.

Those credentials could then be used for pass-the-hash activity against domain controllers.

2. noPac

Hosts that were still vulnerable to:

• CVE-2021-42278
• CVE-2021-42287

could be targeted using the technique commonly known as noPac.

3. PaperCut running on a domain controller

The worst configuration was a PaperCut host that was itself a domain controller, or one where the PaperCut service operated with Domain Admin-level privileges.

In that situation, GreyNoise observed the attacker creating an account and adding it to Domain Admins.

The observed paths ultimately led to DCSync activity and extraction of domain credential material from NTDS.DIT.

The toolkit was mostly familiar

There was no magical new AI-only post-exploitation toolkit.

GreyNoise identified familiar offensive-security tools including:

• Ligolo-ng
• Mimikatz
• Certipy
• BloodHound
• Rubeus
• Impacket
• NetExec

The campaign also used custom tooling, including a Rust-based credential collector.

That is worth emphasizing.

The AI did not need to invent a completely new offensive ecosystem.

It could orchestrate existing tools much faster.

One observed command shows the attacker staging a Windows SYSTEM registry hive and encoding it for transfer:

reg save HKLM\SYSTEM "C:\Windows\Temp\pc-system.hiv" /y & certutil -encode "C:\Windows\Temp\pc-system.hiv" "C:\Windows\Temp\pc-system.b64" & type "C:\Windows\Temp\pc-system.b64"

This is the kind of activity defenders can hunt for independently of the AI component.

What defenders should look for

PaperCut's own advisory includes several indicators of compromise.

One particularly useful detection point is suspicious post-exploitation activity originating from pc-app.exe.

PaperCut also recommends checking for:

• missing, unexpectedly truncated, or deleted server.log files
• suspicious whoami and tasklist execution
• nltest /dclist: activity
• suspicious PowerShell downloads
• unexpected executables under C:\ProgramData
• installation of a Windows service named Remote Access Service
• unexpected SimpleHelp installation
• unexpected AnyDesk installation (PaperCut)

PaperCut specifically notes that the absence of these indicators does not prove that a system was not compromised. (PaperCut)

GreyNoise has also published additional campaign-specific indicators, but PaperCut explicitly warns that those third-party indicators have not been independently verified by PaperCut and should be validated against the organisation's own environment. (PaperCut)

What this changes for defenders

The underlying tradecraft is not particularly futuristic.

CVE exploitation is not new.

Credential harvesting is not new.

Mimikatz is not new.

DCSync is not new.

What changed is the operational layer.

A traditional operator may have to:

1. build a target list
2. scan targets
3. test exploitability
4. inspect failures
5. change parameters
6. retry
7. classify the result
8. continue to the next target

An agentic workflow can automate significant portions of that loop.

That does not make the attacker unstoppable.

It makes the attack cheaper, faster and easier to scale.

What should organisations do?

Patch first

If you run PaperCut NG/MF, check your version.

The current maintenance releases are:

• 26.0.5
• 25.0.13
• 24.1.10

PaperCut says these releases replace the emergency patches and include the relevant security fixes and additional hardening. (PaperCut)

Remove unnecessary internet exposure

PaperCut explicitly recommends restricting Application Server web access to trusted addresses.

Use:

• firewalls
• network ACLs
• VPN
• private network access
• equivalent access controls

Do not leave the Application Server administration surface unnecessarily exposed to the public internet. (PaperCut)

If you were compromised, assume more than initial access

Do not stop the investigation at the PaperCut server.

Hunt for:

• newly created accounts
• Domain Admin membership changes
• LSASS access
• registry-hive staging
• credential dumping
• DCSync
• lateral movement
• remote tunnelling
• suspicious outbound connections
• unexpected administrative tools
• new services
• persistence mechanisms

And investigate the domain controllers.

If credentials or registry secrets were exposed, patching the original PaperCut vulnerability does not automatically invalidate credentials that may already have been stolen.

The AI lesson is about throughput

The most interesting thing about this campaign is not that an AI discovered a new CVE.

The vulnerabilities were still ordinary security flaws.

The offensive tools were mostly familiar.

The post-exploitation techniques were familiar too.

What changed was the ability to operate the whole process at scale.

The attacker could combine:

target discovery → exploit → feedback → classification → retry → credential access → lateral movement

into a workflow that could keep running.

That is what defenders should prepare for.

Not "AI hackers" as some futuristic category.

But ordinary attackers with a much cheaper and faster operational loop.

Hardening still works

There is another detail from the GreyNoise report that is easy to overlook.

At least one target was protected by Cloudflare WAF, which blocked the campaign. (GreyNoise)

That was not an autonomous AI defence system.

It was ordinary defensive infrastructure doing its job.

And that is probably the most useful lesson from the entire incident.

The answer to AI-assisted attacks is not necessarily more AI.

It is still:

• patch management
• attack-surface reduction
• network segmentation
• identity security
• endpoint visibility
• useful logging
• credential hygiene
• tested incident response

AI may increase the attacker's speed.

That makes those fundamentals more important, not less.

If you operate PaperCut across schools, retail branches, managed service providers, or other distributed environments, this is the kind of incident worth rehearsing for.

Because the question is no longer only:

"Can an attacker exploit this server?"

It is also:

"How quickly can they try the same thing against the next 500?"

Related reading: how to reason about AI-agent security and what swarm-scale agent incidents mean for incident response.

Sources

• GreyNoise: Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
• The Hacker News: PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
• PaperCut: URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)
• Rapid7: PaperCut NG/MF Critical Zero-Day Exploited in the Wild