PaperCut MF/NG flaws attacked with hundreds of AI agents

An attacker used hundreds of AI agents to exploit recently disclosed PaperCut MF and NG vulnerabilities, compromising hundreds of organizations globally and rapidly gaining domain administrator access in at least 12 cases, GreyNoise researchers reported Wednesday.

The campaign targets the vulnerabilities tracked as CVE-2026-81578 and CVE-2026-82078, which can be chained together to enable authentication bypass and unauthorized configuration changes leading to remote code execution (RCE). PaperCut issued emergency patches for the actively exploited flaws on Aug. 27, 2026.

GreyNoise found that on Aug. 31, a threat actor using the IP 45.142.193[.]132 began using AI to develop and test PaperCut exploits in a “self-hosted lab environment,” and ultimately deployed hundreds of AI agents in attacks on vulnerable instances. The agents used a DeepSeek AI model with OpenAI’s Codex as a harness, according to GreyNoise.

Blackpoint separately observed the same campaign, revealing more information about threat actor’s AI-assisted workflow based on files recovered from an exposed directory.

From empty workspace to real-world RCE in under 4 hours

GreyNoise’s report noted how the use of AI accelerated the attacks, with the first RCE against a real-world victim coming just less than four hours after the first exploit development began in an “empty workspace.” The first instance of the attacker gaining domain admin came just two hours later, with the fastest time to gain domain admin access being just five minutes.

Related reading:

“In one instance, the adversary went from initial access to full domain administrator in seven minutes against a high school in the United States. However, the adversary did not experience success evenly across all victims. GreyNoise observed the adversary achieved domain admin against only 12 victim organizations,” the company stated.

In total, GreyNoise found that at least 440 PaperCut MF/NG instances were compromised in the campaign, with 395 named victim organizations identified across 48 countries. The highest number of victims (98) were observed in the United States, followed by the United Kingdom, France, Spain and Canada, with education being the most impacted sector, with 204 victim organizations.

Researchers noted this victimology likely reflects PaperCut’s customer base rather than strategic targeting and characterized the attacks as opportunistic. They also found that the threat actor used a list of 28 countries meant to be excluded from attacks, although organizations in these countries were compromised in some cases, including in nine attacks in South Africa and five attacks in Brazil.

Blackpoint’s investigation uncovered how the attacker used an “iterative development process” leveraging AI to research the PaperCut vulnerabilities, code and test exploits, troubleshoot failures and ultimately execute the attack campaign.

“Context was preserved as the project moved from vulnerability research to exploit validation, tooling development, target expansion, and eventually operational execution,” Blackpoint Threat Intelligence Engineer Sam Decker and Principal MDR Analyst Nevan Beal wrote in the report.

The Blackpoint Adversary Pursuit Group found that Hindsight, a persistent memory layer for AI agents, and AionUI, a user interface for coordinating agent-driven workflows, were among the tools discovered in the exposed directory, helping the threat actor orchestrate the hundreds of agents while carrying over context between runs as the operation progressed.

Both Blackpoint and GreyNoise’s reports highlight signs of human intervention during the operation, with GreyNoise noting some multi-day gaps between initial access and domain admin access due to “a lack of action” by the attacker. However, the GreyNoise Research team told SC Media in a statement, “The overwhelming majority of the tasks were autonomous with a handful of perceived human interruptions.”

How agents escalated from PaperCut RCE to domain admin

GreyNoise highlighted three attack paths that the agents took in cases where domain admin was achieved.

In cases where the server hosting PaperCut was a domain member, privileged credentials were harvested from Local Security Authority Subsystem Service (LSASS) process memory and registry secrets, and used to authenticate to the domain controller using “pass-the-hash” methods.   

On systems where the Windows Active Directory Domain Services “noPac” vulnerabilities CVE-2021-42278 and CVE-2021-42287 were not patched, these privilege elevation flaws were also exploited to gain domain admin.

In cases where the PaperCut host was already on the domain controller or running as a domain-admin service account, a new account was simply created and added to domain admins.

In all cases where domain admin was achieved, DCSync was then used to create a full dump of the NTDS.DIT database and exfiltrate the organization’s credentials, GreyNoise said.

GreyNoise identified several tools found in the adversary’s toolkit ranging from credential harvesting and Active Directory abuse to post-exploitation frameworks and EDR evasion tools. However, the researchers noted not all of these tools were used in the attack, including two proof-of-concept (POC) exploits for the Veeam Backup & Replication flaw CVE-2023-27532.

GreyNoise noted that the IP 45.142.193[.]132 was used for malicious activity since at least early July 2026, including in attacks against internet-facing technologies from Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE.

Blackpoint’s report offered recommendations for defenders, which include upgrading PaperCut NG/MF to the latest fixed releases, restricting web access to the PaperCut Application Server and hunting suspicious activity under PaperCut processes including pc-app.exe.

“If exploitation is suspected or confirmed, scope beyond the PaperCut host. Review for privileged account creation, credential access, Active Directory discovery, and internal pivoting,” the Blackpoint analysts wrote.