Threat Intel
AI-Orchestrated Campaign Targets PaperCut NG/MF Vulnerabilities
Threat intelligence sensors have detected an automated campaign leveraging AI to develop and launch exploits against PaperCut NG/MF print management software. The attacks successfully compromised multiple organizations across dozens of countries by targeting critical remote code execution flaws.
What Happened
GreyNoise telemetry identified a coordinated, AI-orchestrated attack campaign targeting self-hosted PaperCut NG and MF instances globally. Operating from infrastructure tracked since July 2026, a Russian-speaking threat actor utilized artificial intelligence to rapidly test and deploy exploits for previously identified vulnerabilities CVE-2026-81578 and CVE-2026-82078. The campaign scanned internet-facing assets via Netlas.io and executed rapid compromises, hitting hundreds of instances worldwide.
Impact and Scope
The automated nature of the operation allowed the adversary to compromise 11 organizations in just 26 seconds, impacting over 440 instances across 48 countries. Because PaperCut NG/MF Java web applications run with SYSTEM-level privileges by default on Windows and frequently integrate with Active Directory environments, successful exploitation grants attackers high-value domain-level access immediately upon entry.
What Defenders Should Do
- Audit perimeter network assets to identify any exposed PaperCut NG/MF instances immediately.
- Apply vendor patches for CVE-2026-81578 and CVE-2026-82078 without delay.
- Restrict external internet access to print management administrative interfaces, placing them behind VPNs or zero-trust network access controls.
- Review Active Directory logs for unauthorized privilege escalation and anomalous service account activity originating from print server hosts.
Related vulnerabilities
CISA Expands KEV Catalog with Two New PaperCut Exploits
CISA has added CVE‑2026‑81578 and CVE‑2026‑82078 to its Known Exploited Vulnerabilities list. Both target PaperCut NG/MF, allowing attackers to bypass authentication or exploit unsafe reflection to gain full control. Federal agencies must now prioritize patching under BOD 26‑04, while all organizations are urged to adopt risk‑based remediation and submit new KEV candidates.
Read briefing
AI‑Powered Attack Hits 395 PaperCut Servers Across 48 Countries
A likely Russian‑speaking threat actor leveraged hundreds of AI agents to craft, test, and launch a global campaign against PaperCut NG/MF servers, exploiting CVE‑2026‑81578 and CVE‑2026‑82078. Within hours of launching, the attackers achieved remote code execution, escalated to domain admin in minutes, and compromised 395 organizations—roughly half in education—across 48 nations. The operation used pass‑the‑hash, DCSync, and custom Rust utilities to harvest credentials and domain secrets. Immediate patching of the two CVEs is mandatory.
Read briefing
CrowdStrike Launches Falcon Guardian: AI‑Driven Runtime Protection for Endpoints
CrowdStrike has unveiled Falcon Guardian, an AI‑powered detection and response platform that protects AI agents at runtime, adds an AI gateway, and expands expert‑led defense capabilities. The solution targets organizations deploying AI workloads and aims to reduce false positives while accelerating incident response.
Read briefing
CyberXero AI‑Powered Campaign Compromises 628,000 Ukrainian Records via WordPress Exploits
CyberXero, a Russian‑speaking threat actor, used Anthropic’s Claude Code to orchestrate an AI‑augmented attack that leveraged WordPress vulnerabilities (CVE‑2026‑63030, CVE‑2026‑60137, CVE‑2026‑4815) and Cobalt Strike to compromise 429 admin panels and exfiltrate 628,000 records from Ukrainian organizations. The campaign also targeted critical infrastructure in Ukraine and other countries. Defenders should patch the CVEs, monitor for unauthorized admin activity, and inspect exposed directories for AI logs and stolen data.
Read briefing