A suspected Russian-speaking threat actor deployed hundreds of AI agents to exploit two PaperCut NG/MF zero-day vulnerabilities, compromising at least 440 server instances across 395 identified organizations in 48 countries, according to independent reports from GreyNoise and Blackpoint Cyber published on September 108,11.
The campaign, tracked from August 31, chained CVE-2026-81578, an authentication-bypass flaw rated CVSS 8.8, with CVE-2026-82078, an unsafe dynamic class-loading bug rated CVSS 9.4, to achieve unauthenticated remote code execution on vulnerable print-management servers5,6. PaperCut had disclosed both flaws on August 27 and issued emergency patches the following day. CISA added both CVEs to its Known Exploited Vulnerabilities catalog.
From empty workspace to domain admin
GreyNoise reported the attacker moved from an empty operational workspace to remote code execution against a live victim in under four hours, then obtained first domain-administrator privileges roughly two hours later12. The fastest escalation to domain admin took five minutes; in one case, a U.S. high school went from initial access to full domain compromise in seven minutes10. Once the automated campaign was fully underway, at least 11 organizations were compromised in 26 seconds.
The agents ran on OpenAI's Codex harness paired with a DeepSeek model, supplemented by commodity offensive-security tools including Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, and custom Rust-based credential collectors7. Blackpoint recovered files from an exposed directory showing the attacker used Hindsight, a persistent memory layer for AI agents, and AionUI, a coordination interface for agent-driven workflows. Target lists were generated through the Netlas.io internet-scanning service using an identified API key.
GreyNoise said "the overwhelming majority of the tasks were autonomous with a handful of perceived human interruptions".
Scope and post-exploitation
Of the 440 compromised instances, GreyNoise observed credential harvesting at 280, operating-system or domain-secret collection at 147, and domain-administrator access at 12 organizations. Three post-exploitation paths were documented: harvesting LSASS memory and registry secrets for pass-the-hash attacks against domain controllers; exploiting the noPac privilege-escalation chain (CVE-2021-42278 and CVE-2021-42287) where those older flaws remained unpatched; and directly adding a new account to Domain Admins when PaperCut ran on a domain controller or under a domain-admin service account. In all cases where domain admin was achieved, DCSync was used to dump the full NTDS.DIT credential database.
Education was the most affected sector, accounting for 204 of the 395 named victims. GreyNoise attributed the concentration to PaperCut's customer base rather than deliberate targeting. The United States led with 98 victims, followed by the United Kingdom with 59, then France, Spain, and Canada. The attacker specified 28 countries to avoid, including Russia, China, Iran, and Ukraine, but agents did not consistently follow these exclusion rules, and victims appeared in several listed countries.
Nevan Beal, principal MDR analyst at Blackpoint, told The Hacker News: "The threat actor's methodology is consistent with initial-access activity, but we do not yet have sufficient evidence to confirm whether they are operating as an initial access broker". GreyNoise said it could not determine whether the actor intends to hand off access or use it directly for data theft or ransomware.
PaperCut on September 10 released maintenance builds 26.0.5, 25.0.13, and 24.1.10, consolidating three prior emergency patches and adding further hardening. Organizations still running emergency-patch builds are urged to upgrade immediately and restrict web access to the PaperCut Application Server.