An intrusion campaign targeting exposed and unpatched PaperCut NG/MF servers has compromised at least 440 installations belonging to 395 organizations across 48 countries. What sets the operation apart is not just the scale of the targets: according to GreyNoise, the threat actor deployed hundreds of AI agents to build, test, and refine attack tools, and then to identify vulnerable systems and strike them rapidly.
The operation reportedly began on August 31 and exploited vulnerabilities CVE-2026-81578 and CVE-2026-82078, security flaws in PaperCut Software that were reported as already actively exploited in the early days of the month. GreyNoise cautiously attributes the activity to a likely Russian-speaking actor. However, it has not identified their ultimate objective: the access gained could serve equally well for data theft or a subsequent ransomware operation.
PaperCut NG and PaperCut MF are platforms used to manage printing, scanning, quotas, and authentication across organizations of all types. For this reason, a PaperCut server joined to a Windows domain network can represent a particularly valuable entry point: if an attacker manages to execute code on it, they can harvest credentials, move laterally to other systems, and target control of the identity infrastructure.
From exploit to domain control in a few hours
GreyNoise describes an operational chain in which OpenAI Codex and DeepSeek models were combined with standard offensive tools. The agents were reportedly assigned distinct tasks: developing and testing exploits, debugging issues, generating lists of potential targets using the Netlas scanning and discovery platform, and then supporting the execution of the campaign. The striking factor is the speed: from starting in an empty workspace to the first remote code execution on a real victim, less than four hours reportedly elapsed. The first account with domain administrator privileges was reportedly reached approximately two hours later.
Once the large-scale campaign was launched, GreyNoise observed at least 11 organizations compromised within 26 seconds. In one case involving a US high school, escalation from initial access to full domain control reportedly took seven minutes. These timeframes drastically reduce the operating window for security teams: an unpatched vulnerability no longer exposes an organization merely to manual attempts, but to procedures capable of adapting and replicating across multiple targets almost simultaneously.
Most of the victims belong to the education sector, which accounts for roughly half of the detected compromises. The United States is the hardest-hit country, followed by the United Kingdom, France, Spain, and Canada. The threat actor had also provided its agents with a list of countries to avoid, including Russia, China, Iran, Ukraine, Belarus, Moldova, Brazil, and South Africa. These instructions, however, were not consistently applied—a detail that highlights the difference between the intentions declared in the campaign's configuration and the actual results on the ground.
What the attackers sought after gaining access
The initial breach of PaperCut servers was only the opening move. According to evidence gathered by GreyNoise, 280 victims suffered credential theft; in 147 cases, operating system or domain secrets were obtained. In 12 organizations, the attackers achieved administrative privileges. The difference is substantial: a stolen password or hash may allow further access attempts, whereas access to domain secrets can turn the compromise of a single host into control over the entire Windows network.
Researchers identified three recurring paths. The first involved dumping LSASS memory and Registry secrets from domain-joined PaperCut servers, followed by using the recovered hashes against domain controllers via pass-the-hash. The second leveraged noPac, a known exploit chain that remains viable in environments unpatched against CVE-2021-42278 and CVE-2021-42287. The third was more direct: when PaperCut ran on a domain controller, or under a service account that already held domain admin privileges, a new user was created and added to the Domain Admins group.
In all observed scenarios, this was followed by DCSync, a post-compromise technique that simulates the behavior of a domain controller to request Active Directory replication data. This allows an attacker to obtain a full dump of NTDS.DIT, the database containing the domain's credentials. At that point, the incident is no longer limited to the single application server originally vulnerable: it affects the entire foundation of trust underpinning the organization's authentication.
The toolkit used includes tools widely seen in security testing and real-world attacks, such as Ligolo-ng, Mimikatz, Certipy, BloodHound, Rubeus, Impacket, and NetExec. GreyNoise also reports custom Rust utilities dedicated to credential harvesting. The presence of well-known software does not reduce the severity of the activity; on the contrary, it makes monitoring behaviors and techniques all the more critical, rather than relying solely on detecting a single piece of malware or a file with a known signature.
AI does not eliminate defenses, but it compresses reaction time
The case does not prove that a generative model can autonomously run a campaign without supervision, nor does it allow the operation to be attributed with certainty to a specific state or criminal group. However, it shows how agents orchestrated by a human actor can accelerate well-known tasks: code writing and review, reconnaissance, target enumeration, exploit testing, and the coordination of subsequent steps.
For organizations, the most practical lesson remains exposure management. PaperCut has released emergency updates for CVE-2026-81578 and CVE-2026-82078, which administrators should apply without waiting for regular maintenance windows. Patching alone, however, may not be enough if the server has already been reached. It is essential to check for any indicators of compromise, anomalous account activity, the creation of new Domain Admins members, logins to domain controllers, and unexpected DCSync requests.
It is also advisable to check whether PaperCut servers are running under overly privileged service accounts or, in the riskiest scenarios, directly on a domain controller. Reducing privileges, isolating exposed services, and applying the relevant Windows fixes against noPac limit the chances of turning an application flaw into a domain-wide incident. If there are signs of credential theft, the response must consider the risk that attackers have already exfiltrated Active Directory data, rather than viewing it merely as a password to be reset.
The campaign observed by GreyNoise therefore shifts the focus from the sheer technical sophistication of the exploit to the speed of the entire offensive cycle. If reconnaissance and experimentation are automated across hundreds of agents, the window between a patch release and compromise can become too short for slow or poorly controlled update processes. For those managing PaperCut, the immediate priority is to remediate the two vulnerabilities and ensure that initial access has not already opened a path toward domain identity compromise.
