Actor Profile

A likely Russian-speaking threat actor leveraged hundreds of AI agents to orchestrate a large-scale exploitation campaign targeting PaperCut NG/MF servers globally. The actor demonstrated advanced automation capabilities by deploying AI models (OpenAI Codex and DeepSeek) to build, test, and refine exploits for CVE-2026-81578 and CVE-2026-82078. The campaign began on August 31, 2026, and successfully compromised 395 distinct organizations across 48 countries. The actor specified an avoidance list including Russia, China, Iran, Ukraine, Belarus, Moldova, Brazil, and South Africa, though AI agents did not consistently honor these restrictions. Motivation appears to be credential harvesting and establishing privileged access, potentially for follow-on data theft or ransomware operations, though ultimate objectives remain unclear.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Exploitation of Public-Facing Application (T1190) via CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF servers. Credential Access: OS Credential Dumping (T1003.001) via LSASS memory dumps using Mimikatz; registry secret extraction; DCSync (T1003.006) to obtain NTDS.DIT dumps. Lateral Movement: Pass-the-Hash (T1550.002) attacks against domain controllers; exploitation of noPac vulnerabilities (CVE-2021-42278, CVE-2021-42287). Privilege Escalation: Direct addition of accounts to Domain Admins group when PaperCut ran on domain controllers or under domain admin service accounts. Discovery: Network scanning via Netlas platform; Active Directory enumeration using BloodHound. Command and Control: Ligolo-ng for tunneling. Execution: Remote Code Execution (RCE) achieved within four hours of campaign start. Toolkit includes Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, and custom Rust credential-collection utilities.

Targets & Patterns

The campaign primarily targeted the education sector, which accounted for approximately 50% of all compromises. At least 440 PaperCut instances linked to 395 organizations across 48 countries were compromised. Geographic targeting focused heavily on Western nations: the United States was most affected, followed by the United Kingdom, France, Spain, and Canada. The actor harvested credentials from 280 victims, obtained operating system or domain secrets from 147 organizations, and achieved administrator privileges at 12 organizations. In one case, a U.S. high school was compromised from initial access to full domain administrator in seven minutes. The targeting pattern suggests opportunistic exploitation of vulnerable internet-facing PaperCut servers rather than highly selective victim profiling, with education sector prevalence likely reflecting widespread PaperCut deployment in academic institutions. The speed of compromise (11 organizations in 26 seconds during full campaign launch) indicates automated, AI-driven target selection and exploitation.

Historical Context

This campaign represents a significant evolution in threat actor capabilities through the operational use of AI agents for end-to-end attack automation. The actor progressed from empty workspace to first RCE against a real victim in under four hours, and achieved first domain admin access within an additional two hours—timelines that compress traditional attack cycles by orders of magnitude. The use of AI models (OpenAI Codex and DeepSeek) for exploit development, testing, and refinement, combined with automated target generation via Netlas, marks a departure from manual or semi-automated attack workflows. The post-exploitation techniques employed (DCSync, pass-the-hash, noPac exploitation) are well-established in the APT and cybercrime playbooks, but their integration into an AI-orchestrated campaign demonstrates how commodity offensive tools can be weaponized at machine speed. The campaign's focus on PaperCut vulnerabilities follows a pattern of threat actors rapidly exploiting newly disclosed flaws in enterprise software, similar to historical mass exploitation events targeting VPN appliances and collaboration platforms.

Defensive Recommendations

  • Apply PaperCut emergency security updates for CVE-2026-81578 and CVE-2026-82078 immediately and follow vendor bulletin guidance to remediate vulnerable instances
  • Detect T1003.001 (LSASS dumping) via monitoring for suspicious access to lsass.exe process memory using Sysmon Event ID 10 with TargetImage containing 'lsass.exe' and GrantedAccess 0x1010 or 0x1410
  • Monitor for T1003.006 (DCSync) by detecting replication requests from non-domain-controller systems via Windows Event ID 4662 with Properties containing '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' or '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'
  • Implement network segmentation to prevent lateral movement and restrict domain controller access; monitor for T1550.002 (pass-the-hash) via unusual NTLM authentication patterns from service accounts
  • Patch CVE-2021-42278 and CVE-2021-42287 (noPac vulnerabilities) if not already addressed; ensure PaperCut servers do not run under domain administrator service accounts or on domain controllers
  • Deploy behavioral detection for rapid credential access patterns and compressed attack timelines (initial access to domain admin in minutes) that may indicate AI-automated exploitation