Hackers Target Schools and Universities Through PaperCut Vulnerabilities

Analysts at the Arctic Wolf Adversary Research Team have observed active exploitation of two recently disclosed PaperCut vulnerabilities — CVE-2026-81578 and CVE-2026-82078. Chained together, they enable an authentication bypass and remote code execution, allowing attackers to run commands, conduct reconnaissance and create privileged accounts.

The education sector took the brunt of it — from schools to large universities in the US and Europe. According to the researchers, once inside, the attackers ran the usual reconnaissance commands (uname, whoami, ver, tasklist) and set up an administrative account with the telling name “Administrator17.”

How the credentials are stolen

Harvesting passwords is central to these attacks. Using the legitimate certutil.exe utility, tools such as lsa_collect.exe, lsa_collect_small.exe and save_hives.exe were delivered from the server 45.142.193[.]132. In a sandbox, lsa_collect.exe extracted specific registry keys in order to reconstruct the system BootKey — which in turn unlocks access to the SAM database and its account hashes.

The stolen data was dumped into files of the form /custom/pcp_*.txt, which were then accessed by incoming GET requests from the same address. In addition, the attackers searched PaperCut configuration files for the strings “password,” “secret,” “ldap,” “bind” and “token” using findstr, and also pulled down Java-based Meterpreter payloads from the host 194.180.48[.]134, establishing sessions through them.

The main danger, Arctic Wolf notes, is that the stolen logins become a springboard to other critical systems within the organization — the compromise of a single print server risks turning into a breach of the entire infrastructure.

What to do

The recommendations are simple but effective: don't expose PaperCut servers to the internet and watch for suspicious activity. In particular, it's worth monitoring the launch of cmd.exe, powershell.exe and other interpreters, as well as commands involving whoami, tasklist, ver or uname -a whenever their parent process turns out to be pc-app.exe.

Source: The Hacker News