An AI-driven hacking campaign has leveraged critical vulnerabilities in PaperCut NG/MF print management software to compromise hundreds of servers across the globe. Researchers from GreyNoise discovered that a coordinated threat actor, believed to be Russian-speaking, used autonomous AI agents to target two key flaws—an authentication bypass (CVE-2026-81578) and a remote code execution via unsafe reflection (CVE-2026-82078). These attacks impacted at least 440 servers in 395 organizations across 48 countries.
How the Attack Unfolded
The intruders selected an infrastructure IP address active since early July 2026. That network, observed probing systems from vendors like Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE, shifted focus on August 31 to the PaperCut vulnerabilities. They built a lab environment mimicking both a PaperCut deployment and its connected Active Directory setup to test exploits before attacks went live. Target systems were identified via the internet scanning platform Netlas.io, accessed using a compromised API key.
Once confidence in the exploits was established, the actor deployed hundreds of autonomous AI agents. These were built using OpenAI’s Codex combined with DeepSeek, alongside known offensive security tools such as Mimikatz, Certipy, Rubeus, and Impacket. With this automation, the campaign moved rapidly: from setting up an empty workspace to executing code on live targets in under four hours. Just two hours later, in some cases, the attackers had Domain Administrator access.
Impact and Geographical Spread
In the first phase of the full-scale campaign, the AI agents compromised 11 organizations in just 26 seconds. In one high-profile case, a U.S. high school network went from initial access to full domain control in seven minutes. However, only 12 of the 440 compromised instances yielded confirmed Domain Administrator access. The time to escalate privileges varied dramatically—from five minutes up to nearly two and a half hours.
Attackers used three primary intrusion paths: harvesting LSASS memory and registry secrets for pass-the-hash attacks; exploiting legacy “noPac” vulnerabilities (CVE-2021-42278, CVE-2021-42287); and, when PaperCut was installed on domain controllers, creating rogue accounts with Domain Admin rights. In every case with confirmed Domain Admin access, the full credential database (NTDS.DIT) was exfiltrated using DCSync operations.
The U.S. bore the brunt of the attacks with 98 compromised servers, followed by the U.K., France, and Spain. Educational institutions made up nearly half of the victims (204 out of 440 systems)—reflecting PaperCut’s prominent use in schools. Curiously, the attackers had instructed their agents to avoid targeting 28 countries—including Russia, China, and Iran—but some victims were recorded in those regions anyway, a discrepancy researchers attributed to “agents gone wild.”
Defenses, Intentions, and Next Steps
Not all attempts succeeded. For example, at least one intrusion was halted by Cloudflare’s Web Application Firewall. This underscores that standard security defenses—even basic edge protections—still matter a great deal in this emerging battleground. The attackers’ ultimate motive isn’t yet clear. There’s no firm evidence that they plan to engage in extortion or collaborate with ransomware groups, though historical PaperCut breaches often end in ransomware activity.
GreyNoise is working with incident response teams to alert affected organizations. Indicators of compromise have been made public via a GitHub repository to help defenders monitor for signs of breach.
This incident shows the rising power and risks of AI-based offensive campaigns. Attackers are no longer human-only adversaries—they’re building systems that act at scale with minimal oversight. As attacker automation improves, organizations must ensure their print management systems are fully patched, external services like Netlas are monitored, and internal defenses—Active Directory configurations, monitoring of credential stores, and privilege management—are hardened. Watch for how this campaign might evolve into ransomware extortion or broader supply chain impact.
