Affected Systems

PaperCut NG/MF (all unpatched versions vulnerable to CVE-2026-81578 and CVE-2026-82078). 440+ instances across 395 organizations in 48 countries compromised, primarily education sector in US, UK, France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland.

Exploitation Status

Active exploitation confirmed since early July 2026. Threat actor (suspected Russian-speaking) using AI agents (OpenAI Codex, DeepSeek) to automate exploitation at scale from IP 45.142.193.132. Domain admin access achieved in 12 organizations; fastest compromise: 7 minutes from initial access to domain admin.

Business Impact

Authentication bypass chained with RCE allows full system compromise. Post-exploitation includes credential harvesting (Mimikatz), Active Directory enumeration (SharpHound, Certipy, Rubeus), and Meterpreter deployment. Attacker achieved domain admin in 12 victims; end goal unclear (possible initial access broker, ransomware, or data theft). AI automation enables rapid retargeting and adaptation—11 organizations compromised in 26 seconds during active campaign phase.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately patch PaperCut NG/MF to address CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution)—consult PaperCut vendor advisory for latest version.
  • Block IP address 45.142.193.132 at perimeter firewalls and review logs for connections from this address since July 2026; investigate any hits for compromise indicators.
  • Hunt for post-exploitation artifacts: Windows registry hive collection tools, Metasploit/Meterpreter Java payloads, Mimikatz, SharpHound, Certipy, Rubeus, and Impacket execution in environments running PaperCut.
  • Review Active Directory for unauthorized privilege escalation, new admin accounts, or suspicious Kerberos ticket activity (Golden Ticket, AS-REP roasting) in PaperCut-connected networks.
  • If PaperCut instance was internet-facing and unpatched, assume compromise: rotate all domain credentials, review domain controller logs, and engage incident response to assess lateral movement and data exfiltration.

---

# Threat Actor Context

Actor Profile

A suspected Russian-speaking cyber actor operating from IP address 45.142.193.132, tracked since early July 2026 for unauthorized port scanning and brute-force attempts. The actor demonstrates advanced technical capabilities, leveraging hundreds of AI agents powered by OpenAI Codex and DeepSeek models to automate exploit development, target selection, and post-exploitation activities. Motivation appears consistent with initial access operations, though it remains unclear whether the actor operates as an initial access broker or intends direct follow-on objectives such as data theft or ransomware deployment. The actor implemented geographic exclusion targeting, attempting to avoid 28 countries including Russia, China, Iran, and Venezuela, though this restraint failed in some instances.

TTPs (Tactics, Techniques, Procedures)

The actor exploits CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) in PaperCut NG/MF. Post-exploitation TTPs include: credential harvesting via Windows registry hive collection tools; deployment of Metasploit/Meterpreter Java payloads; reconnaissance commands for host, user, process, and configuration enumeration; use of offensive security tools including Mimikatz (credential dumping), SharpHound (Active Directory enumeration), Certipy (certificate abuse), Rubeus (Kerberos exploitation), and Impacket (lateral movement). The actor conducted vulnerability research in a self-hosted lab environment with PaperCut and Active Directory, used Netlas.io API for internet-wide target enumeration, and deployed AI-driven multi-threaded validation and exploitation frameworks. Attack lifecycle includes automated target filtering by geolocation and OS, failure analysis with adaptive retry logic, and tracking of post-exploitation task completion (admin access, AD collection, domain discovery, proxy setup).

Targets & Patterns

Primary targeting focuses on the education sector across 48 countries, with confirmed compromises of 440+ PaperCut instances belonging to 395 organizations. Geographic distribution includes the U.S., U.K., France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland. The actor achieved domain administrator access in 12 victim organizations. Target selection methodology involves internet scanning via Netlas.io, geolocation filtering with country-based exclusion lists, and identification of live PaperCut systems. The rapid exploitation timeline—progressing from empty workspace to first RCE in under 4 hours, compromising 11 organizations in 26 seconds during active campaign phases, and achieving full domain admin access in 7 minutes at one U.S. high school—demonstrates automated, scalable targeting. The education sector preference may reflect opportunistic exploitation of vulnerable internet-facing systems rather than strategic sector selection.

Historical Context

The IP address 45.142.193.132 has been tracked by GreyNoise since early July 2026 for probing internet-facing systems from multiple vendors including Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE. Arctic Wolf flagged the same IP address in connection with PaperCut exploitation activity one week prior to the September 2026 reporting. The PaperCut exploitation campaign began in earnest on August 31, 2026, with initial vulnerability research comparing patched and unpatched builds. Within hours, research was converted into operational multi-threaded exploitation tools. This represents an evolution in threat actor capabilities, marking one of the first documented cases of AI agents being integrated throughout the entire attack lifecycle—from vulnerability research and exploit development through target selection, execution, failure analysis, and adaptive retry mechanisms.

Defensive Recommendations

  • Immediately patch PaperCut NG/MF instances to address CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution); prioritize internet-facing installations in education sector environments
  • Block IP address 45.142.193.132 and monitor for reconnaissance activity from Netlas.io scanning infrastructure; implement rate limiting and anomaly detection for authentication attempts against PaperCut services
  • Deploy detection rules for post-exploitation tools: Mimikatz (LSASS access, credential dumping), SharpHound (LDAP queries, AD enumeration), Impacket (SMB lateral movement), Metasploit/Meterpreter Java payloads, and Windows registry hive collection activity
  • Monitor for rapid privilege escalation patterns: detect domain administrator access achieved within minutes of initial compromise, particularly in environments with PaperCut deployments and Active Directory integration
  • Implement network segmentation to limit lateral movement from print management systems; monitor for suspicious outbound connections from PaperCut servers and unusual process execution (PowerShell, Java, credential access tools) originating from print service accounts

---

# Geopolitical Context

Geopolitical Context

The campaign represents a significant evolution in cyber threat capabilities, demonstrating how AI-assisted tooling is lowering barriers to conducting large-scale exploitation at unprecedented speed. The suspected Russian-speaking actor's use of hundreds of AI agents powered by OpenAI Codex and DeepSeek models enabled compression of the attack lifecycle from reconnaissance to domain compromise into minutes rather than days. The targeting pattern—focusing on education sectors across Western nations while explicitly excluding Russia, China, Iran, and other states typically associated with Russian cyber operations—is consistent with either initial access broker activity or pre-positioning for future operations. The four-hour progression from empty workspace to first victim compromise, and 26-second intervals between organizational breaches during active campaigns, illustrates how agentic AI capabilities are fundamentally altering the tempo and scale of cyber operations. The actor's methodical approach—building lab environments, testing exploits, and implementing automated failure analysis and retry mechanisms—suggests a sophisticated operational maturity that blends traditional tradecraft with emerging AI capabilities.

State Actor Alignment

The activity is attributed to a suspected Russian-speaking cyber actor based on linguistic indicators and operational patterns. The IP address 45.142.193.132 has been linked to the campaign by multiple threat intelligence firms (Blackpoint Cyber, GreyNoise, Arctic Wolf). The actor's explicit exclusion list—avoiding targets in Russia, China, Iran, Venezuela, and other states—aligns with typical Russian cyber actor operational security practices designed to minimize domestic legal exposure. However, researchers have not definitively linked this activity to a known Russian state-sponsored group or confirmed whether the actor operates as an initial access broker serving ransomware affiliates or state-aligned entities. The use of commercially available AI models (OpenAI Codex, DeepSeek) and open-source offensive tools (Mimikatz, SharpHound, Impacket) does not provide clear state attribution signals, as these resources are accessible to both state and criminal actors.

Business Impacty pro region

The campaign primarily impacts the education sector across NATO member states and Western-aligned nations, with documented victims in the United States, United Kingdom, France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland—spanning 48 countries total with 395 identified victim organizations. The concentration on educational institutions raises concerns about potential intellectual property theft, research data exfiltration, or pre-positioning for disruptive operations against critical knowledge infrastructure. The rapid compromise timeline (seven minutes from initial access to domain administrator privileges in one U.S. high school case) demonstrates that traditional defensive response windows are insufficient against AI-accelerated attacks. European institutions face particular exposure given the prevalence of PaperCut deployments in academic environments and the actor's demonstrated ability to compromise multiple organizations simultaneously. The campaign's scale—440+ compromised instances—and the uncertainty regarding end objectives (data theft, ransomware deployment, or access brokering) create strategic ambiguity that complicates defensive prioritization and incident response across affected regions.

Forecast

If the actor is operating as an initial access broker, compromised credentials and network access from the 440+ instances may appear on underground markets or be transferred to ransomware affiliates within weeks, potentially triggering a wave of secondary intrusions across the education sector. If the campaign represents state-aligned pre-positioning, the accesses may remain dormant until activated for strategic purposes during periods of geopolitical tension. The demonstrated AI-assisted methodology is likely to be replicated by other threat actors, suggesting that similar campaigns exploiting recently disclosed vulnerabilities at comparable speed and scale will emerge in the coming months. Organizations in the affected sectors and regions should anticipate that traditional patch cycles and detection windows are increasingly inadequate against AI-accelerated exploitation. If attribution firms identify definitive links to known Russian state or criminal groups, Western governments may pursue additional sanctions or cyber response measures, though the use of commercially available AI tools complicates attribution and policy responses.