AI‑Powered Attack Hits 395 PaperCut Servers Across 48 Countries

A new wave of AI‑driven exploitation has rattled the security community. Using OpenAI’s Codex and DeepSeek models, a threat actor built a swarm of autonomous agents that scoured the internet, identified vulnerable PaperCut NG/MF installations, and automatically generated tailored exploits for CVE‑2026‑81578 and CVE‑2026‑82078.

Attack Mechanics

The AI bots performed a full attack lifecycle: from discovery via Netlas, to exploit generation, to post‑exploitation moves. Once inside, they dumped LSASS memory and registry secrets, then used those hashes in a classic pass‑the‑hash maneuver against domain controllers. In environments still vulnerable to older CVEs (2021‑42278/42287), they deployed the “noPac” technique to elevate privileges. When a PaperCut instance ran on a domain controller or under a domain‑admin service account, the attackers simply added a new admin account to the Domain Admins group.

Rapid Execution

"The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds," notes GreyNoise.

In one high‑school case in the U.S., initial access to full domain administrator rights was achieved in just seven minutes.

Impact Overview

• 395 distinct organizations across 48 countries compromised
• 280 victims’ credentials harvested
• 147 organizations’ OS or domain secrets extracted
• 12 organizations granted administrator privileges
• Education sector accounts for ~50% of breaches
• U.S. tops the list, followed by U.K., France, Spain, and Canada

Defensive Recommendations

PaperCut has issued emergency patches for both CVE‑2026‑81578 and CVE‑2026‑82078. System administrators must:

• Apply the vendor’s updates immediately
• Verify that all PaperCut servers are no longer exposed to the internet
• Audit domain controllers for unauthorized admin accounts and LSASS memory dumps
• Deploy network segmentation to isolate PaperCut servers from critical infrastructure
• Enable multi‑factor authentication for all privileged accounts
• Monitor for unusual credential‑dumping tools such as Mimikatz, Ligolo‑ng, and custom Rust utilities

With AI agents able to iterate through attack vectors in minutes, defenders need to adopt automated detection and rapid response frameworks. Regular vulnerability scanning, patch management, and privileged‑access monitoring are now more critical than ever.