PaperCut flaws: AI agents compromised 395 organisations in 48 countries

A campaign started on 31 August, disclosed on 10 September

Threat intelligence firm GreyNoise has documented an exploitation campaign that began on 31 August 2026 and targeted vulnerable PaperCut NG/MF servers. The findings were published on 10 September by Bleeping Computer, relaying the GreyNoise analysis.

Two vulnerabilities are involved, CVE-2026-81578 and CVE-2026-82078, both flagged as actively exploited earlier in the month. What sets this campaign apart is not the flaws themselves but the way they were weaponised: hundreds of AI agents were tasked with building, testing and refining the exploits, combining OpenAI’s Codex model and DeepSeek models with common offensive tooling. The same agents assembled the target lists through the Netlas scanning and discovery platform.

Four hours from an empty workspace to the first victim

The speed figures reported by GreyNoise are what separate this operation from a conventional exploitation campaign. Less than four hours passed between an empty workspace and the first remote code execution obtained against a real victim, then two more hours to the first domain administrator account. Once the full campaign was under way, at least eleven organisations were compromised in twenty-six seconds. In one case, against a high school in the United States, the move from initial access to full domain control took seven minutes.

GreyNoise points out that this kind of attack leaves defenders a very narrow window to react. That is the operational lesson: response procedures calibrated around hours of detection do not cover a campaign that reaches dozens of targets in under a minute.

From print server to domain controller

After the PaperCut exploitation, researchers observed three paths of progression. The first consists of dumping LSASS process memory and registry secrets on domain-joined PaperCut servers, then replaying the recovered password hashes against domain controllers — an attack known as pass-the-hash. The second uses the noPac technique against environments still vulnerable to CVE-2021-42278 and CVE-2021-42287. The third, and most direct, adds a newly created account to the Domain Admins group when PaperCut runs on a domain controller or under a domain administrator service account.

In every case, the DCSync technique was used to obtain a full export of the NTDS.DIT file, that is, the complete set of domain credentials. The toolkit is the one familiar from classic intrusions: Ligolo-ng, Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, rounded out by credential-harvesting utilities written in Rust.

A toll of 395 organisations, mostly in education

GreyNoise data points to at least 440 compromised PaperCut instances, tied to 395 distinct organisations across 48 countries. Credentials were recovered from 280 victims, operating system or domain secrets from 147, and administrator privileges obtained in 12 organisations. The education sector accounts for roughly half of the compromises. The United States is the most affected country, ahead of the United Kingdom, France, Spain and Canada.

The attacker had given the agents a list of countries to avoid — Russia, China, Iran, Ukraine, Belarus, Moldova, Brazil and South Africa — which the agents did not respect consistently. GreyNoise could not determine the campaign’s ultimate objective, but notes that the access obtained can serve data theft as readily as a ransomware operation.

If you administer an affected server, apply the emergency patches released by PaperCut for both vulnerabilities without delay and follow the vendor’s recommendations. In environments where the server was domain-joined, remediation does not stop at the patch: you should treat the domain credentials as exposed.