Attackers chain two PaperCut flaws to lift LDAP and SAM credentials from school print servers

The credential path is the part worth mapping. Arctic Wolf says it saw `findstr` run against PaperCut `*.config` files for the strings password, secret, ldap, bind and token ^[6]. A print server that authenticates users against a directory has to keep a bind account somewhere the application can read it, and that is the file being searched. In a sandbox, the same team watched lsa_collect.exe pull the registry keys needed to rebuild the system BootKey, which is what unlocks the SAM database ^[7]. Service credentials out of configuration, local account hashes out of the registry.

Three of the binaries staged onto victims do that one job: lsa_collect.exe, lsa_collect_small.exe and save_hives.exe, all fetched with certutil.exe from 45.142.193.132 ^[5][13]. That same address then sent inbound GET requests for `/custom/pcp_*.txt` and `/custom/web/pcp_*.txt`, files sitting on the compromised host and holding harvested system and user data ^[4]. Collection leaves by the print server's own web path, with the operator writing results into a directory PaperCut already serves and then retrieving them the way a client would ^[16]. Meterpreter Java payloads came from a second host, 194.180.48.134, which also took the sessions ^[9]. Discovery was ordinary: uname, whoami, ver and tasklist, plus creation of a privileged account named "Administrator17" ^[10].

Chain order decides who is in scope. The authentication bypass, CVE-2026-81578, fronts the remote code execution, CVE-2026-82078 ^[3], so an attempt needs no valid PaperCut login and reachability is the whole prerequisite ^[15].

This is one vendor's telemetry, and it names no patched build number and no victim count ^[14]. Arctic Wolf's guidance is accordingly about reachability rather than a version: keep PaperCut servers off the internet, and alert on cmd.exe, powershell.exe or other interpreters running with pc-app.exe as the parent process, along with commands containing whoami, tasklist, ver or uname -a ^[8]. That parent-child pair is the most useful detection in the writeup, because it fires on the mechanism instead of on any one tool name.

For a PaperCut host that faced the internet during the exposure window, the bind account in its config should be treated as read by someone else until logs say otherwise. Arctic Wolf's stated concern is exactly that: the stolen logins give a pathway into other critical systems across the environment ^[12].