Affected Systems

PaperCut NG and MF, all versions. Primarily targeting education sector (K-12 schools and universities) in the U.S. and Europe. CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) exploited in chain.

Exploitation Status

Active exploitation confirmed by Arctic Wolf. Attackers conducting credential theft, deploying registry harvesting tools (lsa_collect.exe, save_hives.exe), Meterpreter payloads, and creating privileged accounts. Command-and-control infrastructure identified at 45.142.193[.]132 and 194.180.48[.]134.

Business Impact

Attackers gain full system access to PaperCut servers, extract Windows registry hives (SAM database access), harvest credentials, and establish persistent access via Meterpreter. Stolen credentials enable lateral movement to other critical systems. Education sector heavily targeted. Internet-exposed PaperCut servers at immediate risk.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately remove PaperCut NG and MF servers from internet exposure; place behind VPN or restrict access to trusted IP ranges
  • Apply vendor patches for CVE-2026-81578 and CVE-2026-82078 as soon as available; check PaperCut security advisories
  • Hunt for IOCs: outbound connections to 45.142.193[.]132 and 194.180.48[.]134, files lsa_collect.exe, lsa_collect_small.exe, save_hives.exe, certutil.exe usage, privileged account 'Administrator17'
  • Monitor for cmd.exe or powershell.exe spawned by pc-app.exe parent process; alert on discovery commands (whoami, tasklist, ver, uname) and findstr searches in PaperCut config files for 'password', 'secret', 'ldap', 'bind', 'token'
  • Force password resets for accounts on compromised PaperCut servers and connected systems; assume credential compromise if exploitation detected

---

# Threat Actor Context

Actor Profile

The threat actor behind this campaign remains unattributed. Arctic Wolf Adversary Research Team identified the exploitation activity but did not link it to a known APT or cybercrime group. The actor's motivation appears to be credential harvesting and initial access establishment, targeting vulnerable PaperCut servers in educational institutions. The use of commodity tools like Metasploit/Meterpreter and registry harvesting utilities suggests either a financially motivated cybercrime actor or an APT conducting initial access operations for subsequent sale or lateral movement into broader institutional networks.

TTPs (Tactics, Techniques, Procedures)

The campaign leverages CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) in a chained exploit. Post-exploitation TTPs include: T1059.003 (Command and Scripting Interpreter: Windows Command Shell) via cmd.exe and powershell.exe; T1087 (Account Discovery) using whoami commands; T1082 (System Information Discovery) via uname, ver, and tasklist; T1136 (Create Account) with privileged account creation ("Administrator17"); T1003.002 (OS Credential Dumping: Security Account Manager) using lsa_collect.exe and save_hives.exe to extract registry hives and reconstruct the system BootKey for SAM database access; T1105 (Ingress Tool Transfer) via certutil.exe from 45.142.193[.]132; T1005 (Data from Local System) searching PaperCut config files for passwords, secrets, LDAP binds, and tokens using findstr; and T1059.007 (JavaScript) delivering Meterpreter Java payloads from 194.180.48[.]134.

Targets & Patterns

The campaign exclusively targets the education sector, impacting K-12 schools and major universities in the United States and Europe. The targeting pattern suggests opportunistic exploitation of internet-exposed PaperCut print management servers, which are commonly deployed in educational environments for managing printing infrastructure across campuses. Educational institutions represent attractive targets due to often limited security resources, large user bases with valuable credentials, and potential access to research data and administrative systems. The stolen credentials could enable lateral movement into student information systems, financial databases, research networks, and administrative infrastructure.

Historical Context

This campaign represents active exploitation of newly disclosed PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) identified in September 2026. Arctic Wolf's reporting indicates this is an ongoing threat with no direct linkage to previous PaperCut exploitation campaigns. The use of credential harvesting tools and Metasploit payloads aligns with common post-exploitation patterns observed across multiple threat actors, but no specific historical attribution to known groups has been established. The focus on education sector targets and registry hive collection suggests potential preparation for broader network compromise or credential resale on underground markets.

Defensive Recommendations

  • Immediately patch PaperCut NG and MF servers to address CVE-2026-81578 and CVE-2026-82078, and ensure PaperCut servers are not exposed to the internet
  • Monitor for T1059.003 execution of cmd.exe, powershell.exe, or scripting interpreters with pc-app.exe as the parent process using EDR or Sysmon Event ID 1
  • Block network connections to known malicious infrastructure: 45.142.193[.]132 and 194.180.48[.]134 at perimeter firewalls and proxy layers
  • Detect T1003.002 credential dumping by monitoring for execution of lsa_collect.exe, save_hives.exe, or certutil.exe downloading executables, and alert on registry hive access (HKLM\SAM, HKLM\SECURITY, HKLM\SYSTEM)
  • Hunt for T1136 privileged account creation activity, specifically accounts matching patterns like 'Administrator[0-9]+', and review PaperCut logs for suspicious GET requests to /custom/pcp_*.txt paths and findstr commands targeting config files with password-related terms

---

# Geopolitical Context

Geopolitical Context

The active exploitation of PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) against educational institutions in the United States and Europe represents a targeted campaign against a traditionally under-resourced sector with significant intellectual property and research data. Educational institutions—ranging from K-12 schools to major universities—maintain extensive personally identifiable information, research data, and often serve as nodes in national research and innovation ecosystems. The deployment of credential harvesting tools and Meterpreter payloads suggests a campaign oriented toward persistent access and lateral movement rather than immediate financial gain, which is consistent with both cybercriminal pre-positioning for ransomware deployment and state-aligned espionage operations targeting academic research. The transatlantic scope of targeting indicates either an opportunistic exploitation of vulnerable internet-facing systems or a deliberate focus on Western educational infrastructure.

State Actor Alignment

Attribution remains unclear based on available technical indicators. The observed infrastructure (IP addresses 45.142.193[.]132 and 194.180.48[.]134) and tooling—including Metasploit/Meterpreter frameworks and custom credential harvesting utilities—are consistent with both sophisticated cybercriminal operations and state-aligned advanced persistent threat (APT) activity. The focus on credential theft, registry hive extraction, and reconnaissance aligns with tactics observed in both ransomware pre-deployment phases and espionage campaigns targeting academic research. Educational institutions have historically been targeted by state-aligned actors from China, Russia, Iran, and North Korea seeking access to research in sensitive domains including defense technology, biotechnology, and artificial intelligence. However, the education sector is equally attractive to ransomware operators due to operational pressure to restore services quickly. No public attribution has been made by Arctic Wolf or government agencies at this time.

Business Impacty pro region

The targeting of U.S. and European educational institutions highlights persistent vulnerabilities in a sector that serves as critical infrastructure for research, innovation, and workforce development across the transatlantic alliance. Successful credential theft and persistent access could enable attackers to exfiltrate sensitive research data, particularly from universities engaged in dual-use technology development or government-funded research programs. The campaign may also serve as a precursor to ransomware deployment, which has repeatedly disrupted educational operations in both regions over the past several years. For European institutions, this incident underscores ongoing challenges in implementing the NIS2 Directive's cybersecurity requirements across the education sector. For the United States, it reinforces concerns raised by the FBI and CISA regarding the targeting of academic institutions by both nation-state and criminal actors. The transatlantic nature of the campaign may prompt coordinated threat intelligence sharing through existing mechanisms such as the EU-U.S. Joint Cyber Dialogue.

Forecast

If the observed activity represents pre-positioning for ransomware deployment, affected institutions may face encryption or data extortion attempts in the coming weeks, particularly as the academic year progresses and operational pressure to maintain services increases. If the campaign is espionage-oriented, compromised credentials are likely to be leveraged for long-term persistent access to research data and institutional networks, with detection potentially delayed for months. Regardless of intent, the credential harvesting and privileged account creation observed suggests that lateral movement to additional systems within affected institutions is likely already underway. If additional victims are identified and technical indicators are shared through information sharing and analysis centers (ISACs), coordinated patching and incident response may limit the campaign's overall impact. However, if exploitation continues against unpatched systems, the scope of compromise may expand significantly given the large attack surface presented by internet-facing PaperCut servers in the education sector.