Attack on PaperCut: Hundreds of AI Agents Breach 440 Servers in 48 Countries

Blackpoint Cyber and GreyNoise have independently described a campaign in which a presumably Russian-speaking threat actor used artificial intelligence to develop exploits and mass-compromise PaperCut NG/MF print servers. According to the researchers, the attack came from the IP address 45.142.193[.]132, previously spotted scanning ports and attempting password guessing; the same address had been flagged a week earlier by Arctic Wolf.

At the core of the attacks is a pairing of two recent vulnerabilities — an authentication bypass (CVE-2026-81578) and remote code execution (CVE-2026-82078). Hit hardest was the education sector in the United States, the United Kingdom, France, Spain, Canada, Belgium, Portugal, Australia, Germany and Switzerland. After gaining a foothold, the attacker collected Windows registry hives, deployed Metasploit/Meterpreter-based payloads and surveyed hosts, accounts and configurations.

AI as the axis of the whole operation

The most remarkable part is the methodology. The attacker first stood up their own lab with a vulnerable PaperCut and an Active Directory server, rehearsed code execution and credential theft on it, and then unleashed hundreds of AI agents built on OpenAI Codex and the DeepSeek model. They were supplemented by well-known offensive tools — Mimikatz, SharpHound, Certipy, Rubeus, Impacket. In the end, at least 440 PaperCut instances were compromised across 395 organizations in 48 countries.

The speed is striking. GreyNoise estimates that less than four hours passed from an empty workspace to the first remote code execution against a real victim; once the campaign was in full swing, 11 organizations were breached in 26 seconds. In an attack on one American school, the path from initial access to domain administrator rights took seven minutes. That said, the attacker achieved full control over the domain in only 12 organizations.

A curious detail: the attacker tried to exclude 28 countries from the target set, including Russia, China, Iran and Pakistan — but, as GreyNoise notes, this “restraint” failed in places, and organizations on the list were hit after all.

The economics of the attack are changing

Blackpoint found the operator's exposed infrastructure and reconstructed the entire pipeline: from comparing patched and unpatched PaperCut builds to a multithreaded target-checking tool, filtering by country and OS, failure analysis and retries. The project's state was preserved between stages using the open-source tools Hindsight (memory for AI agents) and AionUi (a unified interface for running agents in parallel).

The researchers' main takeaway: the strongest effect of AI here is not a new exploitation technique but a sharp reduction in the manual labor of research, debugging, classification and retries across hundreds of systems. The campaign's ultimate goal remains unclear: either the access is being prepared for handoff to other groups, or the attacker will move on to data theft or ransomware deployment themselves.

Source: The Hacker News