A likely Russian-speaking threat actor deployed hundreds of AI agents to automate the exploitation of two PaperCut NG/MF vulnerabilities, compromising at least 440 servers tied to 395 organizations across 48 countries, according to research from GreyNoise reported by Cyber Security News and CyberPress1,2.
The campaign, tracked from August 31, 2026, chained an authentication-bypass flaw (CVE-2026-81578) with an unsafe-reflection remote code execution flaw (CVE-2026-82078) in PaperCut's self-hosted Java print-management software. On Windows deployments, PaperCut commonly runs with SYSTEM-level privileges, giving attackers a high-impact foothold into enterprise networks.
Speed of compromise
GreyNoise reported that the actor moved from an empty operational workspace to remote code execution against a live victim in under four hours, then obtained its first domain administrator privileges roughly two hours later. In one burst, the operation compromised at least 11 organizations in 26 seconds. A U.S. high school was reportedly taken from initial access to full domain administrator compromise in seven minutes, with the fastest escalation to domain admin occurring in five minutes.
Of the 440 compromised instances, GreyNoise observed credential harvesting at 280, operating-system or domain-secret collection at 147, and domain administrator access at 12 organizations.
AI tooling and offensive stack
GreyNoise observed the threat actor using an OpenAI Codex-based harness, a DeepSeek model, and public offensive-security tools to build, test, and execute attacks in parallel. The operators reportedly built a local test environment containing vulnerable PaperCut software and an Active Directory server while simultaneously generating target lists through Netlas.io.
On domain-joined PaperCut servers, attackers harvested LSASS memory and registry secrets to recover privileged credentials, then used pass-the-hash techniques against domain controllers. In environments still vulnerable to CVE-2021-42278 and CVE-2021-42287, the operators used the noPac Active Directory privilege-escalation technique. In other cases, PaperCut ran directly on a domain controller or under a Domain Admin service account, allowing attackers to add a newly created account, "Administrator17," to the Domain Admins group. Across all observed paths, the attackers used DCSync to replicate Active Directory secrets and create NTDS.DIT credential dumps for exfiltration.
The actor's toolkit included Mimikatz, Certipy, SharpHound, BloodHound, Rubeus, Impacket, NetExec, and Seatbelt, with custom collectors downloaded through certutil. Additional indicators include Rust-based credential and registry collection tools, staged SYSTEM and SECURITY hive files, base64-encoded hive chunks, and Ligolo-ng tunneling binaries deployed under misleading service names. GreyNoise linked campaign orchestration to IP addresses 45.142.193.132 and 45.158.196.75.
Victim profile and mitigations
Education organizations made up the largest affected sector, accounting for 204 victims. The United States led affected countries with 98 victims, followed by the United Kingdom with 59. At least one attempted compromise was blocked by Cloudflare's web application firewall.
GreyNoise recommended that organizations immediately patch exposed PaperCut NG/MF deployments, restrict administrative interfaces from the public internet, and review Active Directory privileges assigned to print servers. Security teams should hunt for suspicious registry-hive dumps, DCSync activity, newly created privileged accounts, Ligolo binaries, and outbound connections to identified attacker infrastructure.
ANALYSIS The campaign marks a concrete, field-observed case of LLM-powered agents compressing the full attack lifecycle, from exploit development through domain takeover, into hours rather than days, with parallelized reconnaissance and exploitation running simultaneously across hundreds of targets.