Security Alert | Hundreds of AI Agents Mass-Exploit PaperCut — 440 Servers, 395 Organizations Breached

🌏 中文版

Incident Overview

Threat intelligence firm GreyNoise and MDR provider Blackpoint Cyber independently tracked the same campaign: a suspected Russian-speaking threat actor, starting August 31, chained two recently disclosed PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078) into unauthenticated remote code execution, then unleashed "hundreds" of AI agents powered by OpenAI Codex and a DeepSeek model to fully automate reconnaissance, exploitation, credential theft, and lateral movement. The campaign has compromised at least 440 servers across 395 organizations in 48 countries, concentrated in the education sector (US, UK, France, Spain, Canada, Belgium, Portugal, Australia, Germany, Switzerland). Security researcher Arctic Wolf had already flagged the same IP address and related exploitation activity a week earlier; GreyNoise and Blackpoint Cyber both published full technical reports in early September, with The Hacker News, GBHackers, cybersecuritynews.com, and cyberpress.org covering the story. This isn't a vulnerability in an AI product — it's a classic software RCE chain (in PaperCut) weaponized at scale by attacker-side AI agent automation.

Key Facts

Attack Surface Analysis

The underlying flaw is a classic pre-auth RCE chain. CVE-2026-81578 is an access-control failure in PaperCut's web management interface: unauthenticated remote requests can trigger backend actions before access validation completes, letting an attacker modify system configuration without ever logging in. CVE-2026-82078 is an unsafe dynamic class loading vulnerability in the database connection utilities — the application instantiates database driver classes based on a configurable driver name with no allowlist validation, so an attacker who can manipulate system configuration parameters can make the server load and execute arbitrary Java bytecode. Chained together, the two produce a fully unauthenticated pre-auth RCE, and PaperCut NG/MF commonly runs with SYSTEM-level privileges on Windows and is frequently integrated directly with Active Directory — turning a print-management server into a pivot point for the entire domain. PaperCut shipped its first emergency patch on August 27; within 48 hours researchers found a bypass, forcing a second emergency release (Emergency Patch Release 2) on August 28.

What makes this worth a security alert isn't the vulnerability itself — it's how the attacker industrialized it. According to Blackpoint Cyber's reconstruction from the attacker's exposed operator infrastructure: starting August 31, the attacker used AI in a self-hosted lab (containing a vulnerable PaperCut instance and an Active Directory server) to repeatedly diff patched-versus-unpatched builds for vulnerability research; within hours, that research had become a multi-threaded validation tool, and target lists were built via the Netlas.io internet-scanning service (using an obtained API key), filtered by geography against an exclusion list (deliberately avoiding Russia, China, Hong Kong, Thailand, Iran, and 24 other countries — though observed victimology shows that restraint failed in some cases). Once live targets were identified, the attacker deployed hundreds of AI agents powered by OpenAI Codex and a DeepSeek model, backed by the Hindsight persistent-memory service (retaining context across research, coding, testing, and campaign-execution stages) and the AionUi multi-agent graphical workspace (running and monitoring many agents at once), to automate Mimikatz (credential dumping), SharpHound (AD reconnaissance), Certipy (AD CS abuse), Rubeus (Kerberos ticket attacks), and Impacket (remote execution). The pipeline tracked every target host by state (active / unreachable / stuck at a stage / eligible for post-exploitation / awaiting retry), logging failures and auto-adjusting strategy rather than treating every failed attempt the same way. GreyNoise observed three lateral-movement paths: dumping credentials from LSASS memory and the registry for pass-the-hash, exploiting the still-unpatched 2021 noPac chain (CVE-2021-42278/CVE-2021-42287), and directly adding rogue accounts to Domain Admins whenever PaperCut happened to be running on a domain controller — with successful compromises followed by a DCSync to exfiltrate the full NTDS.DIT credential database.

Why did it succeed? The root cause isn't that this particular vulnerability chain was uniquely hard to defend — PaperCut issued an urgent advisory the same day it disclosed and told customers to take internet-facing servers offline immediately. It's that AI compressed the traditional "vulnerability research → exploit development → debugging → retargeting → scaling" pipeline — work that used to require a skilled human operator iterating by trial and error — into a self-correcting, continuously running automated system. GreyNoise measured the attacker going from an empty workspace to RCE against a real victim in under four hours; once the campaign scaled in earnest, it compromised 11 organizations in 26 seconds, and one U.S. high school went from initial access to full domain administrator in seven minutes. Blackpoint's conclusion is direct: "The strongest AI impact in this campaign was not a novel exploit technique. It was the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems." Because this isn't a vulnerability in an AI product but an attacker "borrowing" an AI agent's autonomous decision-making and tool-calling capability to scale a classic attack chain, mapped to MITRE ATLAS, the target-filtering and auto-retry pipeline corresponds to AML.T0002 (AI-Automated Reconnaissance) and the mass credential theft and lateral movement to AML.T0014 (Credentials Harvesting). In OWASP LLM Top 10 terms, this incident again lands on LLM06 Excessive Agency — except this time the agent granted excessive autonomy belongs to the attacker.

Defensive Measures

The immediate move is to assume that once a vulnerability is public, it's already being exploited in the wild — don't wait for an internal patch cycle to run its course. PaperCut told customers the day of disclosure to pull internet-facing Application Servers offline, and in hindsight that call was exactly right. Longer term, the reality to internalize is that attackers have now proven that handing a research-to-execution pipeline to parallel, self-retrying AI agents drives down the marginal cost of scaling an attack — and defenders still running on a human-review, human-approval cadence for asset inventory and patching will keep falling further behind.

Immediate Actions

• Upgrade immediately to PaperCut NG/MF Emergency Patch Release 2 (released for v24/v25/v26) — do not stop at the first emergency patch, which has already been shown to be bypassable
• Check for compromise: look for unexpected changes to PaperCut's database connection configuration, unexpected Java subprocesses, LSASS access logs, and DCSync-related events (Event ID 4662); PaperCut's own advisory notes that attackers clean up files and logs, so the absence of artifacts doesn't rule out compromise
• If PaperCut happens to run on a domain controller, assume that DC is compromised, rotate domain-level credentials organization-wide, and check for unauthorized additions to Domain Admins
• If you can't patch immediately, pull internet-facing PaperCut Application Servers offline now rather than waiting for a scheduled maintenance window

Long-term Architecture

• Don't let third-party Java web applications like PaperCut run with SYSTEM privileges directly on domain controllers or other high-privilege hosts; segment print-management infrastructure away from core AD infrastructure
• Build automated containment capable of matching "machine-speed" attacks (one-click credential revocation, host isolation, outbound connection freezes) — assume attacker-side automation speed will keep approaching, or exceeding, human incident-response reaction time
• Evaluate watchlist B7 tools like Straiker and Noma Security that specialize in detecting anomalous agent runtime behavior, to add coverage for "many automated agents coordinating an attack" patterns that traditional signature-based detection misses
• Shorten patch SLAs for high-risk publicly disclosed CVEs — this incident shows the window from disclosure to mass automated exploitation can now be hours to days rather than the weeks organizations have historically budgeted for

Impact Assessment

Of the 440 compromised servers GreyNoise observed, 280 showed confirmed credential-harvesting activity and 147 had operating-system or domain-secret collection — but only 12 organizations saw the attack escalate all the way to full domain administrator access, showing this campaign scaled wide without always scaling deep. The attacker's ultimate objective remains unclear; both GreyNoise and Blackpoint note it's not yet possible to confirm whether this actor intends to sell the access already obtained to other groups (an initial-access-broker model) or pursue further data theft or ransomware deployment directly — historically, PaperCut-related exploitation has often led to ransomware deployment. PaperCut's own blog has also confirmed receiving multiple customer reports of genuine compromise, not merely scanning noise.

If your organization self-hosts PaperCut NG/MF, or any third-party Java web application deeply integrated with Active Directory and running with elevated privileges, the takeaway here isn't just "one more CVE to patch." It's that attackers have now demonstrated that scaling a public vulnerability into mass global scanning and automated lateral movement is a job measured in hours to days — not the weeks a dedicated human red team would previously have needed to plan such an operation.

Takeaway

My instinct with AI-driven attack stories has usually been to look for a novel exploitation technique the AI discovered. This incident is a reminder that the real force multiplier is often somewhere else entirely — PaperCut's two vulnerabilities are a routine researcher disclosure and a normal vendor patch cycle, a classic RCE chain — and the power here came from AI turning "vulnerability research to mass-scale execution," a pipeline that used to require humans iterating step by step and coordinating with each other, into an assembly line that tracks its own progress, auto-retries failures, and continuously accumulates context. Once the marginal cost of attacking drops toward zero, the question defenders face isn't "how dangerous is this vulnerability" anymore — it's "how much runway is left before this vulnerability gets weaponized at scale."

References

• PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances — The Hacker News
• Death by a Thousand PaperCuts: AI-Driven Exploitation at Scale — Blackpoint Cyber (original research)
• Hackers Deploy Hundreds of AI Agents to Compromise PaperCut Servers — GBHackers
• Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws — cybersecuritynews.com
• PaperCut NG/MF Urgent Security Advisory (CVE-2026-81578 / CVE-2026-82078) — PaperCut official
• PaperCut RCE CVE-2026-81578 & CVE-2026-82078 — Horizon3.ai