Hundreds of AI agents drove one IP into 440 PaperCut servers across 48 countries
GreyNoise and Blackpoint Cyber trace the new PaperCut auth-bypass chain to one scanning address running AI agents against schools, which turns an unpatched print server from a maintenance ticket into a credential incident.
The Watch · Security desk
What happened
- Blackpoint Cyber and GreyNoise independently attribute exploitation of the PaperCut NG/MF authentication bypass and remote code execution chain, CVE-2026-81578 and CVE-2026-82078, to a single IP address, 45.142.193[.]132.
- GreyNoise counts no less than 440 compromised PaperCut MF/NG instances hosted by 395 identified victim organizations across 48 countries.
- The targeting is opportunistic and concentrated on education, with victims in the US, UK, France, Spain, Canada, Belgium, Portugal, Australia, Germany and Switzerland.
- The operator ran hundreds of AI agents powered by OpenAI Codex and a DeepSeek model to drive the intrusions rather than working the target list by hand.
- GreyNoise says the suspected Russian-speaking actor kept an exclusion list of 28 countries including Russia, China and Iran, and that the restraint failed in some instances.
Why it matters
- Who's exposed exposure An internet-facing PaperCut server on a pre-fix build now sits in front of a working chain and a pre-built Netlas-derived target list, so the remediation clock is set by the operator's retry waves rather than by the next maintenance window.
- What it costs cost For the 383 organizations that kept their domain, the bill is credential rotation and Active Directory review on the assumption hives were read, which costs far more staff time than the update itself.
- What's now possible capability Patch-diff to working mass-exploitation tool inside a day means the safe interval defenders assume after a fix ships no longer holds for any product whose builds can be compared.
- What it sets up precedent With the objective unresolved, these accesses can be sold on or re-entered later, so a victim seeing no ransomware this month has no basis to close the case.
Next story · Invest · Oct 9
OpenAI and Anthropic executives war-game the backlash from an AI cyberattack insiders expect within a yearConfirmed4 publishers
Twelve of the 395 named victim organisations lost domain administrator access [12]. That is about 3 percent [22]. The other 383 [24] were left with code execution on a print server and whatever was taken on the way through, and Arctic Wolf's list of observed post-exploitation says what that was: Windows registry hive collection tools, Metasploit and Meterpreter Java payloads, and commands to enumerate hosts, users, processes and sensitive configuration data [21]. Registry hives are credential material. A box in that 383 is a credential incident whether or not the domain fell.
The speed is what breaks existing response plans. GreyNoise clocks the operator moving from an empty workspace to remote code execution against a real victim in just under four hours [8], then compromising at least 11 organisations in 26 seconds once the campaign began in earnest [9], an average of one organisation every 2.4 seconds [23]. At one US high school, initial access to full domain administrator took seven minutes [10].
Blackpoint recovered the operator's exposed infrastructure and dates the earliest activity to August 31, when the project was comparing patched and unpatched PaperCut builds; researchers Sam Decker and Nevan Beal write that within hours that research had become a multi-threaded validation tool, reviewed, tested and run against progressively larger target sets [19]. The same infrastructure shows target filtering, failure analysis, code changes and repeated retry waves [18]. Target lists were merged using the internet scanning service Netlas.io with an identified API key [13], and the chain was rehearsed in a self-hosted lab holding vulnerable PaperCut and an Active Directory server [11]. The offensive tooling underneath is Mimikatz, SharpHound, Certipy, Rubeus and Impacket [3], which any operator would have used last year. What the agents changed is the throughput of the loop around it.
Neither firm publishes a disclosure date for CVE-2026-81578 or CVE-2026-82078 [1], so the interval from fix to mass exploitation cannot be stated here. The one anchor is that a patched build existed to diff by August 31 [20]. The objective is also open: GreyNoise says it is unclear whether the actor is developing access to hand to affiliated actors or intends to use it directly for data theft or ransomware [15].
The address itself has been on GreyNoise's radar since early July 2026, probing internet-facing systems from Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE [17], and Arctic Wolf flagged it for this campaign last week [16]. Blocking it is bookkeeping. The 440 figure is also a floor rather than a total, because GreyNoise says there are further real victims it could not tie to a named organisation [5].
What to watch
- A follow-on report tying any of the 440 accesses to data theft or ransomware would settle the handoff question GreyNoise left open.
- Vendor or scan-derived counts of PaperCut instances still exposed on pre-fix builds.
- Whether the same operator points the identical workflow at another edge product it has already been scanning.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption38
- Hype gap+20
- Incentives40
- Confidence66
Perspective Coverage
6 publishers- Builder
- Builder 31%
- Operator
- Operator 57%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The attacks exploit CVE-2026-81578 and CVE-2026-82078, a combination of an authentication bypass and remote code execution chain in PaperCut NG/MF. The reporting gives no disclosure date for either CVE.
- [2]
A suspected Russian-speaking cyber actor has been attributed to using artificial intelligence to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances.
- [3]
The threat actor was observed unleashing hundreds of AI agents powered by OpenAI Codex, a DeepSeek model, and publicly available offensive security tools including Mimikatz, SharpHound, Certipy, Rubeus and Impacket.
- [4]
The agents compromised no less than 440 instances of PaperCut MF/NG hosted by 395 identified victim organizations in 48 countries.
- [5]
GreyNoise: there are other real victims that could not be attributed to a named organization.
- [6]
GreyNoise: the adversary explicitly attempted to avoid targeting entities in 28 identified countries, including Russia, China, Hong Kong, Thailand, Iran, Venezuela, Indonesia, Pakistan and Bangladesh, but observed victimology shows the attempted restraint failed in some instances.
- [7]
The opportunistic attacks mainly target the education sector in the U.S., the U.K., France, Spain, Canada, Belgium, Portugal, Australia, Germany and Switzerland.
- [8]
GreyNoise: the attacker progressed from an empty workspace to first achieving remote code execution against a real victim in just under four hours.
- [9]
GreyNoise: the attacker compromised at least 11 organizations in 26 seconds once the campaign began in earnest.
- [10]
In one attack targeting a high school in the U.S., the duration between initial access and full domain administrator access was seven minutes.
- [11]
GreyNoise: as part of exploit development and testing, the adversary built and attacked a lab environment that included the vulnerable PaperCut software and an Active Directory server.
- [12]
The adversary gained domain administrator access against only 12 victim organizations.
- [13]
GreyNoise: in parallel workflows the adversary built target lists using the internet scanning service Netlas.io with an identified API key.
- [14]
According to independent reports from Blackpoint Cyber and GreyNoise, the activity originates from the IP address 45.142.193[.]132, which has been linked to unauthorized port scanning and brute-force attempts in recent weeks.
- [15]
GreyNoise: it is unclear if the actor is solely focused on access development to be handed off to other affiliated actors, or if it will directly leverage the accesses for follow-on objectives such as data theft or ransomware deployment.
- [16]
The same IP address was flagged by Arctic Wolf in connection with the same activity last week.
- [17]
GreyNoise has been tracking malicious use of the IP address since early July 2026 for probing internet-facing systems from vendors including Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE.
- [18]
Blackpoint traced the activity to exposed operator infrastructure depicting the AI-assisted workflow from vulnerability research and exploit development through execution, target filtering, failure analysis, code changes and repeated retry waves.
- [19]
Blackpoint researchers Sam Decker and Nevan Beal: the earliest recovered activity began on August 31, with the project focused on vulnerability research comparing patched and unpatched PaperCut builds, and within hours that research had been turned into a multi-threaded validation tool that was reviewed, tested and run against progressively larger target sets.
- [20]
A fixed PaperCut build existed on or before August 31, 2026, since the operator's earliest recovered work was a comparison of patched and unpatched builds on that date.
- [21]
Arctic Wolf: observed post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes and sensitive configuration data.
- [22]
The 12 organizations that lost domain administrator access are about 3 percent of the 395 identified victim organizations.
- [23]
Compromising 11 organizations in 26 seconds is an average of about one organization every 2.4 seconds.
- [24]
383 of the identified victim organizations did not lose domain administrator access.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comAI-powered attack exploited PaperCut flaws to hack 395 organizations
1 article · September 10, 2026
- helpnetsecurity.comAI agents exploited PaperCut flaws to breach 395 organizations
1 article · September 11, 2026
- scworld.comPaperCut MF/NG flaws attacked with hundreds of AI agents
1 article · September 10, 2026
- securityweek.comPaperCut Flaws Exploited in AI-Powered Attacks
1 article · September 11, 2026
- thecyberexpress.comAI Agents Compromised 440 PaperCut Servers, Researchers Say
1 article · September 10, 2026
- thehackernews.comPaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
2 articles · September 10, 2026
Topics and entities
Topics
- Vulnerability Exploitation
- AI-Enabled Cyberattacks
- Active Directory Security
- Education Sector Security