Hackers Deploy Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers

A likely Russian-speaking threat actor used hundreds of AI agents to automate exploitation of PaperCut NG/MF vulnerabilities, compromising at least 440 servers linked to 395 organizations across 48 countries.

The campaign, tracked from August 31, 2026, demonstrates how large language model-powered automation can accelerate attack operations from reconnaissance through Active Directory compromise.

GreyNoise said the actor moved from an empty operational workspace to remote code execution against a live victim in under four hours, then obtained its first domain administrator privileges roughly two hours later.

Hackers Deploy Hundreds of AI Agents

The attackers exploited two PaperCut flaws: CVE-2026-81578, an authentication-bypass vulnerability, and CVE-2026-82078, an unsafe reflection remote code execution flaw.

PaperCut NG and MF are self-hosted Java print-management applications frequently integrated with Active Directory. On Windows deployments, the software commonly runs with SYSTEM-level privileges, making a successful compromise a potentially high-impact foothold into enterprise networks.

GreyNoise observed the threat actor using an OpenAI Codex-based harness, a DeepSeek model, and public offensive-security tools to build, test, and execute attacks in parallel.

The operators reportedly built a local test environment containing vulnerable PaperCut software and an Active Directory server, while simultaneously generating target lists through Netlas.io.

Once the attack chain was validated, the agents opportunistically scanned and attacked exposed PaperCut instances at machine speed.

In one burst, the operation compromised at least 11 organizations in only 26 seconds. A U.S. high school was reportedly taken from initial access to full domain administrator compromise in seven minutes.

The campaign was not equally successful across every target. Of the 440 compromised PaperCut instances, GreyNoise observed credential harvesting at 280 and operating-system or domain-secret collection at 147.

The actor achieved domain administrator access at 12 organizations, with the fastest escalation occurring in five minutes. Where escalation succeeded, the actor used three principal paths.

On domain-joined PaperCut servers, attackers harvested LSASS memory and registry secrets to recover privileged credentials, then used pass-the-hash techniques against domain controllers.

In environments still vulnerable to CVE-2021-42278 and CVE-2021-42287, the operators used the “noPac” Active Directory privilege-escalation technique.

In other cases, PaperCut ran directly on a domain controller or under a Domain Admin service account, allowing the attackers to add a newly created account, identified as Administrator17, to the Domain Admins group.

Across all observed paths, the attackers used DCSync to replicate Active Directory secrets and create NTDS.DIT credential dumps for exfiltration. GreyNoise linked campaign orchestration to the IP addresses 45.142.193.132 and 45.158.196.75.

Additional indicators include Rust-based credential and registry collection tools, staged SYSTEM and SECURITY hive files, base64-encoded hive chunks, and Ligolo-ng tunneling binaries deployed under misleading service names.

The actor used tools including Mimikatz, Certipy, SharpHound, BloodHound, Rubeus, Impacket, NetExec, and Seatbelt. It also downloaded custom collectors through certutil, a common living-off-the-land technique.

Education organizations made up the largest affected sector, accounting for 204 victims. The United States led affected countries with 98 victims, followed by the United Kingdom with 59.

Organizations should immediately patch exposed PaperCut NG/MF deployments, restrict administrative interfaces from the public internet, and review Active Directory privileges assigned to print servers.

Security teams should hunt for suspicious registry-hive dumps, DCSync activity, newly created privileged accounts, Ligolo binaries, and outbound connections to identified attacker infrastructure.

GreyNoise noted that at least one attempted compromise was blocked by Cloudflare’s web application firewall, underscoring that conventional patching, segmentation, least privilege, and monitoring remain effective even as adversaries increasingly automate intrusions with AI.

Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC

The post Hackers Deploy Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers appeared first on Cyber Security News.