Executive Summary
A highly automated campaign targeting PaperCut NG/MF software has been identified, utilizing AI agents to accelerate exploitation and post-exploitation workflows. The actor, suspected of being Russian-speaking, utilized a specialized AI workbench called PentAGI to manage over 1,000 targets globally, achieving rapid scaling from initial breach to domain administrator status in some instances within hours.
The attack chain involves exploiting unauthenticated RCE vulnerabilities (CVE-2026-81578 and CVE-2026-82078) via PaperCut's Tapestry component and an alternative XML-RPC path to modify database configurations. Once access is gained, the actor deploys a sophisticated pipeline for credential theft (LSA secrets and service passwords), internal network pivoting via reverse SOCKS5 tunnels (using Chisel), and automated Metasploit exploitation.
This campaign represents a significant shift in threat tradecraft, demonstrating how AI can orchestrate concurrent attacks against hundreds of organizations. Affected sectors include education, government, and nonprofits across Western Europe, North America, and Asia-Pacific. Organizations running PaperCut must prioritize patching and perform deep forensic analysis for signs of persistence beyond initial exploit mitigation.