Threat
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
Publication date not yet evaluated · Added · 5 reports greynoise.io
Page published · Page updated
Coverage timeline
Why it matters
The PaperCut campaign is a real-world demonstration of AI agents orchestrating the full exploitation lifecycle — reconnaissance, exploit development, lateral movement, and exfiltration — at machine speed and scale, signaling a shift in how defenders must anticipate the cyber kill chain.
GreyNoise and Blackpoint reported that a likely Russian-speaking actor used hundreds of AI agents trained in a lab environment to develop, test, and deploy exploits for two PaperCut NG/MF vulnerabilities (CVE-2026-81578 and CVE-2026-82078), compromising at least 440 instances across 395 organizations in 48 countries. The AI swarm achieved RCE in under four hours, Active Directory domain admin two hours later, and compromised 11 organizations in 26 seconds once launched, with tooling managing 500+ targets, 200 concurrent processes, and up to 100 retry rounds.
Summary
A likely Russian-speaking actor exploited two PaperCut NG/MF vulnerabilities — CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe-reflection remote code execution) — using AI and hundreds of AI agents, compromising at least 440 PaperCut instances hosted by 395 organizations across 48 countries.[0][6][28]
The defining feature was operational scale enabled by AI rather than a novel exploit technique: the operator developed and tested exploits in a self-hosted lab (including vulnerable PaperCut and an Active Directory server), then used AI agents to research, validate, retry, and continuously improve exploitation, going from an empty workspace to first RCE against a real victim in under four hours and compromising at least 11 organizations in 26 seconds.[0][6]
Blackpoint's Adversary Pursuit Group traced the activity to exposed operator infrastructure at 45.142.193.132, whose open HTTP directory preserved an AI-assisted workflow spanning vulnerability research (comparing patched and unpatched PaperCut builds), proof-of-concept development, a country-filtered targeting funnel of more than 500 systems, and timestamped state files tracking failures and retries.[28]
Attack chain
- Vulnerability research: Beginning August 31, 2026, the operator conducted vulnerability research comparing patched and unpatched PaperCut builds to identify the exploitable flaws.[6][28]
- Exploit development and validation: Within hours the research was turned into a multithreaded validation tool that was reviewed, tested, and run against progressively larger target sets; the operator validated RCE and credential harvesting in a self-hosted lab that included vulnerable PaperCut and an Active Directory server before scaling.[6][28]
- Target sourcing and filtering: An automated targeting funnel merged multiple source lists (including lists built with the Netlas.io internet scanning service via an identified API key), geolocated candidates, filtered by country, and used reachability scripts with 32 and 80 workers to identify live PaperCut systems before heavier processing.[6][28]
- Initial access: The actor chained CVE-2026-81578 authentication bypass and CVE-2026-82078 unsafe-reflection remote code execution to break into internet-facing PaperCut NG/MF instances, which by default run with SYSTEM privileges and are usually domain-joined.[6]
- Privilege escalation and Active Directory compromise: After achieving RCE and credential harvesting, the operator opportunistically attempted to compromise Windows Active Directory environments, reaching first domain admin roughly two hours after first RCE.[0][6]
Disclosure timeline
| Date | Event |
|---|---|
| Early July 2026 | GreyNoise began tracking malicious use of 45.142.193.132 for attacks against internet-facing Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE technologies.[6] |
| August 31, 2026 | Earliest recovered operator activity: a likely Russian-speaking actor used 45.142.193.132 and AI to conduct vulnerability research comparing patched and unpatched PaperCut builds, rapidly turning it into a multithreaded validation tool.[6][28] |
| September 9, 2026 | GreyNoise published its analysis of the AI-orchestrated campaign against PaperCut NG/MF.[0][6] |
| September 11, 2026 | Dark Reading published aggregated reporting on the campaign and its implications for the cyber kill chain.[0] |
How it works
The attacks chain CVE-2026-81578, an authentication bypass, with CVE-2026-82078, an unsafe-reflection remote code execution flaw, to gain code execution on internet-facing PaperCut NG/MF servers. Because PaperCut NG/MF are self-hosted Java web applications that by default run with SYSTEM-level privileges on Windows and are usually domain-joined and Active Directory-integrated, code execution provides a strong foothold for lateral movement.[6]
The operator developed the exploit by comparing patched and unpatched PaperCut builds in a self-hosted lab that included the vulnerable PaperCut software and an Active Directory server, then achieved RCE and credential harvesting in that lab before scaling against real targets.[6][28]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| PaperCut NG/MF | Internet-facing self-hosted instances vulnerable to CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe-reflection RCE) | Patched builds exist; the operator compared patched and unpatched builds during research, indicating fixed versions are available and unpatched instances remain at risk.[6][28] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| ip | 45.142.193.132 | Operator/source IP for the campaign, tracked by GreyNoise since early July 2026 and hosting the exposed operator directory that Blackpoint's APG analyzed.[6][28][29] |
| cve | CVE-2026-81578 | Authentication bypass in PaperCut NG/MF chained in the campaign.[6][36] |
| cve | CVE-2026-82078 | Unsafe-reflection remote code execution in PaperCut NG/MF chained with the authentication bypass.[6][37] |
Key takeaways
- The strongest AI impact in this campaign was not a novel exploit but the reduction of human effort to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems, changing the economics of mass exploitation.[28]
- AI-driven automation dramatically compressed timelines — under four hours from an empty workspace to first live RCE, and at least 11 organizations compromised in 26 seconds — underscoring the need for rapid patching of internet-facing services.[0]
Defensive actions
- Apply PaperCut NG/MF patches for CVE-2026-81578 and CVE-2026-82078 and remove internet exposure of PaperCut management interfaces.: The campaign exploits these two flaws as an auth-bypass-to-RCE chain against internet-facing PaperCut servers, and the operator specifically researched unpatched builds.[6][28]
- Block and hunt for activity from 45.142.193.132 and review logs back to early July 2026.: This IP is the campaign's source and operator infrastructure, tied to scanning and exploitation across the GreyNoise and Blackpoint reports.[6][28]
- Enforce multifactor authentication, limit permissions, shorten session-token lifetimes, and monitor for abnormal behavior in Active Directory environments.: These fundamentals prevent identity/session abuse and slow lateral movement, giving defenders time to react against AI-accelerated attacks that reached domain admin quickly.[0]