Death by a Thousand PaperCuts: AI-Driven Exploitation at Scale

Summary

Independent reports from Blackpoint Cyber and GreyNoise, aggregated by The Hacker News, attribute a large-scale exploitation campaign against PaperCut NG/MF to a suspected Russian-speaking actor who chained CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) to compromise at least 440 PaperCut instances across 395 victim organizations in 48 countries, primarily in the education sector.^[0]

The defining feature of the campaign was operational scale enabled by AI rather than a novel exploit: the operator deployed hundreds of AI agents (powered by OpenAI Codex and a DeepSeek model) plus off-the-shelf offensive tooling to research, develop, test, retry, and continuously improve exploitation, achieving first RCE against a real victim in under four hours and domain administrator access at one U.S. high school in seven minutes.^[0]

Blackpoint's Adversary Pursuit Group traced the activity to exposed operator infrastructure at 45.142.193.132, whose open HTTP directory preserved an AI-assisted workflow spanning vulnerability research (comparing patched and unpatched PaperCut builds), proof-of-concept development, tooling hardening, a country-filtered targeting funnel of more than 500 systems, and timestamped state files tracking failures and retries.^[0][8]

Attack chain

1. Vulnerability research: Beginning August 31, the operator conducted vulnerability research comparing patched and unpatched PaperCut builds to identify the exploitable flaws.^[0][8]
2. Exploit development and validation: Within hours the research was turned into a multithreaded validation tool that was reviewed, tested, and run against progressively larger target sets, with an AI-supported iterative loop informing code changes and troubleshooting.^[0][8]
3. Target sourcing and filtering: A targeting funnel merged multiple source lists (including target lists built with the Netlas.io internet scanning service via an identified API key), geolocated candidates, applied a country exclusion policy, deduplicated URLs, and used reachability scripts to identify live PaperCut systems before heavier processing.^[0][8]
4. Initial access: The actor chained CVE-2026-81578 authentication bypass and CVE-2026-82078 remote code execution to break into internet-facing PaperCut NG/MF instances.^[0]
5. Credential harvesting and privilege escalation: After gaining RCE, the operator used offensive tools such as Mimikatz, SharpHound, Certipy, Rubeus, and Impacket to harvest credentials and escalate, reaching domain administrator against 12 organizations.^[0]
6. Post-exploitation: Observed post-exploitation included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, Active Directory collection, domain/network discovery, proxy setup, and commands to identify hosts, users, processes, and sensitive configuration data.^[0]

Disclosure timeline

How it works

The attacks exploit CVE-2026-81578 and CVE-2026-82078 as a combined chain: an authentication bypass followed by remote code execution against PaperCut NG/MF, giving the attacker code execution on internet-facing print-management servers.^[0]

The operator developed the exploit by comparing patched and unpatched PaperCut builds in a self-hosted lab that included the vulnerable PaperCut software and an Active Directory server, then achieved RCE and credential harvesting in that lab before scaling against real targets.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• The strongest AI impact was not a novel exploit but the reduction of human effort to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems, changing the economics of such attacks.^[0][8]
• AI-driven automation compressed timelines dramatically — under four hours from empty workspace to first live RCE and seven minutes from initial access to domain admin in one case — underscoring the need for rapid patching of internet-facing services.^[0]
• The actor's end goals are unclear; it may be developing access for handoff to affiliates or pursuing data theft or ransomware directly.^[0]

Defensive actions

• Apply PaperCut NG/MF patches for CVE-2026-81578 and CVE-2026-82078 and remove internet exposure of management interfaces.: The campaign exploits these two flaws as an auth-bypass-to-RCE chain against internet-facing PaperCut servers, and the operator specifically researched unpatched builds.^[0]
• Block and hunt for activity from 45.142.193.132 and review logs since early July 2026.: This IP is the campaign's source/operator infrastructure, tied to scanning, brute force, and exploitation across multiple reports.^[0][8]
• Hunt for post-exploitation tooling and behaviors: Mimikatz, SharpHound, Certipy, Rubeus, Impacket, Windows registry hive collection, and Meterpreter-related Java payloads, plus rapid domain-admin escalation.: These tools and behaviors were observed in post-exploitation, and escalation to domain administrator occurred in as little as seven minutes.^[0]