An AI-agent campaign compromised 440 PaperCut servers. Patching without hunting the print server is not remediation.

GreyNoise measured 395 organizations in 48 countries. PaperCut’s QA’d maintenance releases replace the emergency patches. CISA KEV due 14 September.

RWP Ventures · 2026-09-11 · event 2026-08-31 · 12 min read · priority 8.8

The same window, PaperCut shipped QA’d maintenance releases 26.0.5, 25.0.13, and 24.1.10. Those builds replace Emergency Patch Releases 1–3. CISA KEV’d both CVEs on 31 August; federal due date is 14 September. Forensic-triage flag: No. That flag does not mean “patch and close.” PaperCut NG/MF on Windows runs as SYSTEM by default and is usually domain-joined. GreyNoise watched one U.S. high school go from initial access to domain admin in seven minutes.

The emergency patch stops the next request. It does not unscrew LSASS, Administrator17, hive dumps under C:\Windows\Temp\pc-*.hiv, or Ligolo under C:\ProgramData. Hunt first if the Application Server answered from the internet after 27 August.

What happened

PaperCut disclosed active exploitation of its Application Server on 27 August 2026 after a university customer and its DFIR team handed the vendor enough to reproduce. Two CVEs, assigned 28 August:

Huntress reproduced a pre-authentication configuration takeover and a complete RCE chain against stock PaperCut NG 25.0.11. PaperCut considers all versions of NG and MF in scope. Cloud PaperCut is not this product; this is the self-hosted Java Application Server.

CISA added both CVEs to KEV on 31 August (due 14 September). The notes say they chain. PaperCut’s own post-exploit picture from the first wave: pc-app.exe spawning cmd.exe, whoami & ver, nltest /dclist:, then SimpleHelp installed as a Windows service named “Remote Access Service” and an AnyDesk drop. Vendor log strings that still matter: jdbc:derby:memory:pwn;create=true, CAST(X'cafebabe, No suitable driver found for jdbc:no:x.

GreyNoise is the increment, not the CVE listing. The firm had already been watching 45.142.193.132 since early July against Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE. On 31 August that host pivoted to PaperCut. GreyNoise’s reconstruction: the operator stood up a lab with vulnerable PaperCut plus Active Directory, built target lists via a Netlas.io API key, then launched hundreds of agents. Empty workspace to first real-victim RCE in under four hours; first domain admin two hours after that; once the full campaign ran, 11 organizations in 26 seconds.

Blackpoint Cyber, independently, recovered operator project state after containing an internet-facing PaperCut Application Server. Timestamped agent context, retry lists, up to 200 concurrent targets, Hindsight (persistent agent memory) and AionUI (orchestration UI) in the broader environment. Blackpoint’s finding, which we will not over-read: this is AI assistance across research, PoC, targeting, and retry — not a claim that a model independently discovered the zero-days or ran without a human.

PaperCut’s 10 September bulletin: new compromises have slowed; most customers have either firewalled the Application Server or patched; hosts that remain public and unpatched are still being hit; second-wave post-compromise has been more sophisticated than the first days. GreyNoise is that second wave. The vendor also pointed at GreyNoise’s IoCs without independently verifying them.

Why it matters

Three facts should not be collapsed.

First: this is not “AI found a zero-day.” The bugs were vendor-confirmed, KEV’d, and emergency-patched before the 31 August mass run. The AI layer is speed and concurrency on a known chain against a product class that sits on Windows as SYSTEM and talks to Active Directory. Four hours from empty workspace to RCE on a live victim is a defender-margin problem, not a science-fiction problem.

Second: the print server is an identity problem. GreyNoise’s three domain-admin paths were all identity, not printers:

• Path A — domain-joined PaperCut host, LSASS and registry secrets, pass-the-hash to a DC.
• Path B — noPac (CVE-2021-42278 / CVE-2021-42287) where those 2021 bugs were still open.
• Path C — PaperCut on a domain controller, or running as a Domain Admins service account; add a new account to Domain Admins.

Every successful DA path ended in DCSync / NTDS.DIT. Credential harvesting on 280 of 440 is the common case. Domain admin on 12 is the expensive tail. Do not average those together and call the campaign “just print.”

Third: the agents did not obey the operator. GreyNoise recovered a 28-country avoid list (Russia, China, Hong Kong, Thailand, Iran, Venezuela, Belarus, the Stans, Ukraine, Brazil, Vietnam, Indonesia, Pakistan, several African states, and others). Observed victimology includes South Africa, Brazil, China, Kazakhstan, Pakistan, Namibia, Nigeria, Zimbabwe — the restraint failed. That is an operational fact about unconstrained agents. It is not a reason to skip the hunt.

For industrial operators: GreyNoise’s industry table includes 13 victims tagged Manufacturing / Industrial / Energy / Utilities. That is IT compromise at industrial organizations. There is no confirmed OT, ICS, or physical-process impact in GreyNoise, Blackpoint, or PaperCut. Do not write a PLC event. Do inventory whether a plant print server is domain-joined to the same AD the engineering workstations use.

Who / what is affected

Technical context

RWP is not reproducing the HTTP shape, the Derby gadget, or a class-loading recipe. PaperCut’s public description is enough: unauthenticated admin-function requests mutate configuration (81578); the database connector then loads a driver class from that configuration without an allowlist (82078); bytecode on the classpath runs as pc-app. On Windows that is SYSTEM.

ATT&CK mapping for what GreyNoise and PaperCut observed, not a hypothetical:

• Initial access: exploit public-facing application (T1190)
• Execution: command and scripting interpreter / Java (T1059)
• Credential access: LSASS memory, Security Account Manager, DCSync (T1003 / T1003.006)
• Persistence: remote access software — SimpleHelp, AnyDesk, Ligolo-ng (T1219 / T1090)
• Lateral movement: pass-the-hash (T1550.002); noPac where 2021 AD bugs remain
• Privilege escalation: create account / Domain Admins (T1136 / T1078)
• Collection / exfil: registry hives staged as pc-.hiv / pc-.b64

GreyNoise hashes worth hunting (MD5 as published): lsa_read.exe 528cd4e69ecfa5191adbcf6ef28667bf; save_hives.exe ce870a91e8d27e8f663f0687abc60b04; collect_custom.exe a6437ac3d6798090a218520985d36a3f; lsa_collect_small.exe fc92dfafa7aa741c5f2b9cbcf75d1d19. Account: Administrator17. Staging: C:\Windows\Temp\pc-sys.hiv, pc-sec.hiv, pc-*.b64. Tunnel: C:\ProgramData\ligolo-agent.exe, C:\ProgramData\LegitSvc\legit-svc.exe. PaperCut web drop: ...\PaperCut MF\server\custom\web\pcp_<10rand>.txt. Orchestration IPs: 45.142.193.132, 45.158.196.75. GreyNoise will keep adding on GitHub; these are not exhaustive. The operator changed tooling on the fly.

Cloudflare’s WAF stopped at least one exploit attempt GreyNoise watched. Hardening still works against agentic noise. Do not infer from that one block that a public PaperCut is safe.

Threat / exploitation status

High confidence on: vendor confirmation, KEV listing and 14 September due date, the two-CVE chain, GreyNoise’s published counts and IoCs as their telemetry, PaperCut MR version numbers. Moderate confidence on actor identity beyond “likely Russian-speaking.” Low confidence on remaining internet-facing population and on whether accesses get sold.

What defenders should do

1. Find every PaperCut NG/MF Application Server. Version, whether pc-app is reachable from untrusted networks, whether it is domain-joined, whether it runs on a DC, whether the service account is Domain Admins. Include school sites, libraries, MSP-managed print, and plant offices. Cloud PaperCut is a different product.
2. Hunt before you call the upgrade a close. PaperCut server.log: jdbc:derby:memory:pwn, CAST(X'cafebabe, jdbc:no:x, missing or truncated logs. On disk: <install>\server\lib\<5-char>.class, server\data\content\<5-char>.cmd / .out, server\custom\web\pcp_.txt. Process: pc-app.exe → cmd.exe / whoami. Windows: service “Remote Access Service” / SimpleHelp SimpleService.exe; unexpected AnyDesk; Administrator17; hive files pc-.hiv / pc-*.b64; Ligolo paths above; hashes above; egress to 45.142.193.132 and 45.158.196.75. Absence of those files is not a clean bill — PaperCut notes attackers delete them.
3. Upgrade to the maintenance release, not an old emergency patch. PaperCut NG/MF 26.0.5, 25.0.13, 24.1.10. They contain Emergency Patch Releases 1–3 plus hardening, and they have been through standard QA. If you are on Release 3 only, you are protected against these two CVEs but PaperCut still wants the MR. If you are on Release 1 or 2, upgrade now. Pull installers and SHA-256 from the live bulletin, not from a cached copy. If you use an external database for card/ID lookup, read the FAQ — that config moved into security.properties.
4. Take the Application Server off the internet unless it must be there, and then only behind allowlisting / WAF. GreyNoise’s one Cloudflare block is the existence proof that a front-end control still eats this chain.
5. If IoCs hit, or the box was internet-facing and unpatched after 27 August, do not “just patch.” PaperCut’s compromised-server guidance is still: secure backups, wipe and rebuild the Application Server, restore a known-clean backup. Then treat AD: krbtgt if DA was possible, privileged users, PaperCut service account, any DCSync window. Check CVE-2021-42278 / 42287 while you are there. Rotate what the print server could touch.
6. KEV clock is 14 September, three days after Magento StyleSmuggler and N-central (11 Sep) and two after FMC / NetScaler / FortiOS (12 Sep). Sequence internet-facing PaperCut and those edge boxes first, then the rest of September Patch Tuesday.

This is not an exploitation guide. Use PaperCut’s bulletin, GreyNoise, and CISA KEV.

RWP assessment

Score 8.8. A measured, 395-organization, AI-orchestrated campaign against a SYSTEM-on-the-domain print server, with a same-window vendor MR and a 14 September KEV date, is the first material development after [yesterday’s FMC root-exploitation assessment](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/). The CVEs are two weeks old. The census, the agent workflow, and the DA timing are not.

It outranks MikroTik RouterOS KEV (CVE-2026-67277, CVE-2026-86060, added 10 September, due 13 September). CERT Polska’s MikroTrick chain was already in the field when we passed on it 9 September; CISA’s listing is a real clock — 86060 carries a forensic-triage flag — but it is a continuation, not a new victim picture. Shadowserver’s ~122,500 SSH-reachable MikroTiks are exposure, not confirmed takeovers at PaperCut’s documented scale.

It outranks Wiz’s JFrog Artifactory exploitation (CVE-2026-42018 + CVE-2026-42016 chain 15 August–8 September; CVE-2026-82329 1–8 September). Supply-chain blast radius is worse in the abstract — admin on the artifact repo, Groovy plugins, Rust backdoors, join-key theft. CVE-2026-82329 has been KEV since 2 September (due 5 September, already lapsed). Wiz’s public write-up does not give a 395-org census. Hunt it this week if you run self-hosted Artifactory. It is not today’s decision.

It outranks ShieldCrash, Nightmare Eclipse’s public Defender PoC claiming a bypass of the ShieldBreak patch (CVE-2026-69414) on September-patched Windows. Arbitrary file read as SYSTEM is published. Microsoft has not confirmed the bypass. There is no KEV and no confirmed in-the-wild use. Local EoP after a foothold is not 440 internet-facing Application Servers.

What we are watching

• Whether CISA flips the ransomware-use flag on 81578 / 82078, or a named crew starts encrypting from these accesses.
• Whether GreyNoise’s operator hands the 440 footholds to affiliates, or keeps them.
• PaperCut’s next bulletin if a third wave appears after the MR.
• MikroTik CVE-2026-86060 forensic-triage due 13 September; FMC / NetScaler / FortiOS due 12 September.
• Artifactory 42016/42018/82329: additional victim reporting, join-key rotation, admin accounts named jfrog-distribution / 0xTerror / svc_*.
• Magento StyleSmuggler and N-central CVE-2026-86218: federal due 11 September — today, if those estates were not triaged.

Sources

• GreyNoise — Agents Gone Wild: AI-orchestrated campaign against PaperCut NG/MF
• GreyNoise — supplemental IoCs
• PaperCut — Security Bulletin 27 August 2026 (updated 10 September)
• CISA Known Exploited Vulnerabilities Catalog
• Blackpoint Cyber — Death by a Thousand PaperCuts
• Rapid7 — PaperCut NG/MF critical zero-day exploited in the wild
• BleepingComputer — AI-powered attack exploited PaperCut flaws to hack 395 organizations
• The Hacker News — PaperCut replaces emergency patches
• CISA — two MikroTik KEV additions, 10 September 2026
• Wiz — Artifactory under attack (CVE-2026-42016 / 42018 / 82329)
• [RWP Daily Top, 10 September 2026 — Cisco FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/)