AI-orchestrated campaign exploits PaperCut NG/MF flaws, compromising 440+ instances across 48 countries

Linha do tempo

1. greynoise.io ↗ · pub. 08/09/2026 21:00 · coletado 19/10 18:37 primeiro registro

   AI-orchestrated campaign exploits PaperCut NG/MF flaws, compromising 440+ instances across 48 countries

   ler a análise desta fonte ocultar

   GreyNoise reports that on 31 August 2026 a likely Russian-speaking malicious cyber actor used 45.142.193.132 and AI to develop, test and deploy exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). Using hundreds of AI agents built on OpenAI's Codex harness, a DeepSeek model and public offensive security tools, the actor compromised at least 440 PaperCut instances at 395 identified organizations in 48 countries. The actor went from an empty workspace to RCE against a real victim in under four hours and compromised at least 11 organizations in 26 seconds once the full campaign launched. It achieved domain admin at only 12 victims, the fastest in five minutes. It is unclear whether the actor will hand off access or pursue data theft, ransomware or extortion. Earlier PaperCut intrusions have led to extortion. GreyNoise has been tracking the same IP since early July 2026 for attacks on Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE.

   Technical Details

   • PaperCut NG/MF is self-hosted Java web software that runs as SYSTEM by default on Windows and is usually domain-joined and integrated with Active Directory.
   • The actor built a lab with vulnerable PaperCut and an Active Directory server to develop RCE and credential harvesting. In parallel it built target lists with the Netlas.io scanning service using an identified API key.
   • Three observed paths to domain admin:
     1. On a domain-member host, the actor harvested LSASS memory and registry secrets and used pass-the-hash against the domain controller.
     2. Where CVE-2021-42278 and CVE-2021-42287 were unpatched, the actor ran a noPac attack.
     3. If PaperCut ran on the domain controller or under a Domain Admin service account, the actor added its own new account to Domain Admins.
   • On every path the actor used DCSync to dump NTDS.DIT and exfiltrate credentials.
   • The actor's exclusion list covered 28 countries (including Russia, China, Iran, Ukraine and Brazil), but the agents still compromised victims in some of them.
   • Targeting was opportunistic, with many U.S. education victims, likely reflecting PaperCut's customer base. In one case a high school went from initial access to domain admin in seven minutes.
   • Cloudflare WAF blocked the actor in at least one instance. GreyNoise says the IOCs are not exhaustive because the actor adapted on the fly.

   Remediation

   • Patch PaperCut NG/MF against CVE-2026-81578 and CVE-2026-82078, and patch domain controllers for CVE-2021-42278 and CVE-2021-42287.
   • Do not expose PaperCut management interfaces to the internet, and put a WAF in front of them where exposure is unavoidable.
   • Avoid running PaperCut as a Domain Admin service account or on a domain controller, and review Domain Admins for unexpected new accounts.
   • Hunt for LSASS access, DCSync activity and NTDS.DIT dumps, and block 45.142.193.132.
   • Follow GreyNoise's GitHub for updated IOCs.