A threat actor believed to be Russian-speaking used hundreds of AI agents to build, test, and improve exploits for two vulnerabilities in PaperCut NG/MF servers, then launched a global breach campaign that began on August 31, 2026. According to data from threat intelligence company GreyNoise, the operation compromised at least 440 PaperCut instances linked to 395 organizations in 48 countries.
The campaign targeted CVE-2026-81578 and CVE-2026-82078, two vulnerabilities affecting PaperCut Software that were reported as being actively exploited earlier in September. The operation combined OpenAI Codex and DeepSeek models with commercially available offensive tools, while the agents used the Netlas platform to scan the internet and create target lists.
Breach Tally
The education sector was the most affected, accounting for about half of the observed breaches. The United States was the leading targeted country, followed by the United Kingdom, France, Spain, and Canada. GreyNoise said the attacker identified countries it wanted to avoid, including Russia, China, Iran, Ukraine, Belarus, Moldova, Brazil, and South Africa, but the agents did not consistently follow these rules.
The attackers collected credentials from 280 victims and obtained operating system or domain secrets from 147 victims. They also gained domain administrator privileges at 12 organizations. GreyNoise did not identify the campaign's ultimate objective, but the level of access achieved could have been used to steal data or carry out ransomware extortion operations.
Post-Compromise Paths
Researchers observed three main paths after exploiting PaperCut. The operation included dumping LSASS memory and registry secrets from domain-joined PaperCut servers, then using the extracted credential hashes in pass-the-hash attacks against domain controllers. noPac attacks were also used against environments that remained vulnerable to CVE-2021-42278 and CVE-2021-42287.
In other cases, the attackers directly added a new account to the Domain Admins group when PaperCut was running on a domain controller or using a service account with domain administrator privileges. Across all paths, the attackers used DCSync after the compromise to obtain a complete dump of the NTDS.DIT file, which contains domain credentials.
The toolkit used included Ligolo-ng, Mimikatz, Certipy, BloodHound, Rubeus, Impacket, and NetExec, along with custom credential-collection tools written in Rust.
Why Does This Matter?
The most important development is not merely the use of known offensive tools, but the speed at which the attack stages were coordinated. GreyNoise said the actor went from an empty workspace to executing remote malware access against a real victim in less than four hours, then needed an additional two hours to reach the first domain administrator. After the campaign was launched, at least 11 organizations were compromised within 26 seconds, while one attack moved from initial access to full domain administrator privileges within seven minutes against a U.S. high school.
The report recommends that system administrators immediately apply PaperCut's emergency security updates addressing CVE-2026-81578 and CVE-2026-82078, in addition to following the company's recommendations in the relevant security bulletin. The source does not specify whether the campaign actually resulted in data theft or ransomware deployment, and the identity of the perpetrating actor has not been determined.