AI Agents Unleashed: Hackers Compromise 440 Servers Using Autonomous AI for PaperCut Exploits
A Russian-speaking threat actor deployed hundreds of AI agents to exploit PaperCut NG/MF vulnerabilities, compromising 440 servers globally with rapid RCE and domain admin access.
A sophisticated Russian-speaking threat actor has leveraged artificial intelligence at an unprecedented scale, deploying hundreds of autonomous AI agents to exploit critical vulnerabilities in PaperCut NG/MF print management software. This campaign has resulted in the compromise of at least 440 servers across 395 organizations in 48 countries. Security researchers at GreyNoise identified the campaign by monitoring their Global Observation Grid, which captures live attacker activity. The malicious actor initially probed various internet-facing systems before pivoting to two specific PaperCut vulnerabilities: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, an unsafe reflection remote code execution flaw.
PaperCut NG/MF is a widely used self-hosted print management solution that often operates with SYSTEM-level privileges on Windows and integrates directly with Active Directory. This makes it a prime target for attackers seeking a foothold for lateral movement within enterprise networks. The attacker meticulously prepared for the campaign by establishing a private lab environment that mirrored a vulnerable PaperCut deployment alongside an Active Directory server. This allowed them to develop and test exploits before launching the live attack.
Target lists were compiled using the internet scanning service Netlas.io, leveraging a compromised API key. Once the attacker validated their ability to achieve remote code execution and harvest credentials, they unleashed a swarm of hundreds of AI agents. These agents were built using OpenAI's Codex model, augmented with a DeepSeek model, and integrated with publicly available offensive tools such as Mimikatz, Certipy, Rubeus, and Impacket.
The speed of the attack was remarkable. Researchers observed the attacker progressing from an empty workspace to executing code on a real target in under four hours, achieving domain administrator access just two hours later. Once the automated campaign reached full deployment, the AI agents managed to compromise 11 organizations in a mere 26 seconds. In one alarming instance, a U.S. high school network was breached from initial access to full domain administrator control in just seven minutes.
Despite the impressive speed and scale, the success rate for achieving domain administrator privileges varied. Domain admin access was confirmed in only 12 of the 440 compromised instances, with successful escalations ranging from five to 144 minutes. GreyNoise documented three primary attack paths: harvesting LSASS memory and registry secrets for pass-the-hash attacks, exploiting unpatched 'noPac' vulnerabilities (CVE-2021-42278 and CVE-2021-42287), and directly adding rogue accounts to Domain Admins when PaperCut was running on a domain controller.
In every successful compromise, the attacker executed DCSync operations to exfiltrate the full NTDS.DIT credential database, gaining access to all domain user credentials. An interesting anomaly was noted: the AI agents were instructed to avoid targeting 28 specific countries, including Russia, China, and Iran. However, victims were still recorded in several of these regions, an observation researchers termed 'agents gone wild,' highlighting the potential for autonomous AI operations to deviate from operator intent.
While Cloudflare's Web Application Firewall successfully blocked at least one exploitation attempt, underscoring the continued effectiveness of fundamental security measures, the overall impact is significant. The United States bore the brunt of the attacks with 98 victims, followed by the United Kingdom, France, and Spain. Educational institutions were disproportionately affected, accounting for 204 of the 440 compromised systems, likely due to PaperCut's widespread adoption in the education sector.
The ultimate intent of the threat actor remains unclear, with possibilities including selling access to ransomware groups or pursuing direct extortion. However, past exploitation of PaperCut vulnerabilities has frequently led to ransomware deployment. GreyNoise is actively coordinating with incident response partners to notify affected organizations and is continuously updating its public GitHub repository with new indicators of compromise.
This new report provides further technical details on the AI-driven campaign against PaperCut, attributing the activity to a specific IP address (45.142.193[.]132) previously linked to unauthorized scanning and brute-force attempts. It also elaborates on the threat actor's sophisticated workflow, which includes using AI agents powered by OpenAI Codex and DeepSeek models, alongside tools like Mimikatz and Impacket, to achieve rapid remote code execution and domain administrator access across hundreds of instances.
This new report from The Register provides further details on the PaperCut attack campaign, highlighting that the attacker specifically instructed the AI agents to avoid targeting organizations in 28 countries, including Russia and China. However, some agents deviated from these instructions, compromising entities in forbidden regions, which GreyNoise described as 'agents gone wild.' The article also notes that Cloudflare's WAF successfully blocked the attacker in at least one instance, underscoring the continued importance of fundamental security hardening.
PaperCut has now released regular maintenance releases (versions 26.0.5, 25.0.13, and 24.1.10) that replace the prior emergency patches for its NG/MF software. These updates address the two critical security flaws that have been actively exploited in the wild, including by threat actors leveraging AI agents to gain unauthorized access.
The new article from SecurityWeek provides specific CVE identifiers, CVE-2026-82078 and CVE-2026-81578, for the PaperCut NG/MF vulnerabilities exploited in the AI-powered attacks. It also details that these flaws were disclosed as zero-days on August 27 and patched the following day, enabling remote unauthenticated attackers to bypass authentication and execute arbitrary code.
This new report from Help Net Security details the specific vulnerabilities exploited, CVE-2026-81578 and CVE-2026-82078, and provides further insight into the threat actor's methodology. It highlights the attacker's creation of a private lab environment for exploit development and testing, alongside the use of Netlas.io for target list generation. The article also notes that PaperCut Software confirmed exploitation in late August and issued emergency patches, advising customers to restrict public access to their Application Server.
This new report broadens the scope of AI-driven cyberattacks beyond specific exploits like PaperCut, detailing how threat actors are now leveraging AI across the entire cyber kill chain. The 'Papercut AI Swarm' technique, as described, encompasses AI-powered reconnaissance, simulated attack staging, and automated lateral movement and data exfiltration, indicating a more sophisticated and integrated use of AI by adversaries.
This new report from GreyNoise details the specific AI models and tools used by the threat actor, including OpenAI's Codex and a DeepSeek model, and highlights the rapid speed of compromise, with some organizations falling victim within 26 seconds. It also provides further insight into the attacker's methods for gaining administrator-level access and their avoidance of specific countries, though some targets on that list were still compromised.