Threat reportVulnerabilityTL-2026-3740
AI-Agent-Driven Exploitation of PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) Leads to Windows Credential Theft and Domain Admin Compromise
AI-Agent-Driven Exploitation of PaperCut NG/MF (TL-2026-3740) is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-10-16. It has no confirmed attribution, affects PaperCut PaperCut NG/MF, references 2 CVEs (CVE-2026-81578, CVE-2026-82078), maps to 16 MITRE ATT&CK techniques (T1003.001, T1003.002, T1003.004), and is covered by 9 detection rules and 22 indicators of compromise.
- CVSS
- 9.4/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-3740
- Threat ID
- TL-2026-3740
- Severity
- CRITICAL
- CVSS
- 9.4
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- education, retail, professional services, hospitality, government administration, health, legal
- Target regions
- united states of america, united kingdom, france, spain, canada, belgium, portugal, australia, germany, switzerland
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in AI-Agent-Driven Exploitation of PaperCut NG/MF
Malware and tooling: Certipy, Chisel, Impacket - S0357, Ligolo-ng, Mimikatz, Rubeus - S1071, SharpHound/BloodHound, metasploit
How AI-Agent-Driven Exploitation of PaperCut NG/MF works
A likely Russian-speaking operator used hundreds of AI agents (OpenAI's Codex harness driving a DeepSeek model) to chain two PaperCut NG/MF flaws, compromising at least 440 instances across 395 organizations in 48 countries. Post-exploitation focused on Windows credential harvesting, reverse proxying/tunneling and Active Directory abuse, reaching domain administrator at 12 organizations.
CVE-2026-81578 (CVSS 8.8) is an authentication bypass in the PaperCut NG/MF web management interface: unauthenticated requests to administrative functions trigger backend actions before access validation. CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class-loading flaw in PaperCut's database connection utilities, which load database driver classes from configurable driver names without an allowlist. Chained, they give pre-authentication remote code execution; PaperCut runs as a Java web application, frequently with SYSTEM-level privileges on Windows. Public sources describe execution via H2/Groovy on 26.x and Apache Derby on earlier versions, with command output retrieved through temporary files in PaperCut's web directory, plus an XML-RPC alternative path. (Note: some secondary outlets describe the two CVEs differently, e.g. as pre-auth RCE and post-auth sandbox escape; the primary-vendor/GreyNoise descriptions above are used here.)
PaperCut issued an urgent bulletin on 2026-08-27 after exploitation was seen in customer environments from about 2026-08-26 (Huntress). CVE IDs and scores were assigned 2026-08-28, and Emergency Patch Releases followed, with a third release on 2026-09-01 (24.1.10, 25.0.13, 26.0.5) after bypass paths against earlier fixes were found. Both CVEs were reported added to CISA KEV.
On 2026-08-31 an actor operating from 45.142.193.132 began developing and testing exploits in a self-hosted lab with AI agents (Hunt.io observed empty workspace to real-world RCE in under four hours; first RCE on a real target in Australia at 18:39 UTC; domain admin validation about 21:00 UTC). On 2026-09-01 (08:30 UTC) the actor launched the full campaign and compromised 11 organizations in 26 seconds. Target lists were built using Netlas.io with an identified API key, merged through a funnel with geolocation and a 28-country exclusion list (Russia, China, Iran, Venezuela and others) that agents did not consistently honor.
Blackpoint Cyber found the same IP serving an open HTTP directory (ports 8000/18080/18081; ~3.9 GB, 1,924 files) holding the operator's entire workspace: scripts, target lists, state files and failure logs. Tooling included Metasploit/Meterpreter Java payloads (2,165 attempts, 5 interactive sessions), custom Windows utilities (save_hives.exe, lsa_read.exe, collect_custom.exe), Certipy, Mimikatz, SharpHound/BloodHound, Rubeus, Impacket, NetExec, Ligolo-ng, Chisel with cron persistence on Linux, and live_reverse_socks5.py (45 active reverse SOCKS5 pivots at capture). The agent stack also used Hindsight (persistent agent memory) and AionUi (concurrent-agent workspace).
Post-exploitation harvested Windows SECURITY/SYSTEM registry hives, LSA secrets, LDAP bind passwords, and database/service-account credentials (280 victims credential theft; 147 with OS/domain secrets). Three domain-admin paths were used: LSASS/registry dumping with pass-the-hash, noPac (CVE-2021-42278/42287), and direct Domain Admins group addition via compromised service accounts, followed by DCSync. Domain admin was achieved at 12 organizations, in 5 to 144 minutes (7 minutes at a US high school). Education was the primary sector (204 victims, ~46-50%). The end goal is unconfirmed (possible access brokering, ransomware or data theft). Cloudflare WAF blocked exploitation in at least one case.
MITRE ATT&CK techniques used in TL-2026-3740
Credential Access
T1003.001 LSASS Memory; T1003.002 Security Account Manager; T1003.004 LSA Secrets; T1003.006 DCSync; T1552.001 Credentials In Files
Persistence
T1053.003 Cron; T1136.002 Domain Account
Execution
T1059 Command and Scripting Interpreter
Discovery
Command and Control
T1090 Proxy; T1572 Protocol Tunneling
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
Resource Development
Reconnaissance
Affected products and versions in AI-Agent-Driven Exploitation of PaperCut NG/MF
- PaperCut — PaperCut NG/MF
Vulnerable versions: 24.x before 24.1.10; 25.x before 25.0.13; 26.x before 26.0.5
Fixed in: 24.1.10; 25.0.13; 26.0.5
Remediation for AI-Agent-Driven Exploitation of PaperCut NG/MF
Patches
- PaperCut NG/MF 26.0.5
- PaperCut NG/MF 25.0.13
- PaperCut NG/MF 24.1.10
Immediate actions
- Upgrade PaperCut NG/MF to 26.0.5, 25.0.13 or 24.1.10 (Emergency Patch Release 3) or later
- Remove PaperCut management interfaces from direct internet exposure; restrict admin access by IP
- Block 45.142.193.132 and 45.158.196.75 at the perimeter and review historic logs for contact
- Hunt for save_hives.exe, lsa_read.exe, collect_custom.exe, certipy.exe, Chisel/Ligolo-ng binaries and unexpected cron entries on PaperCut hosts
- If compromise is suspected, rotate LDAP bind, database and service-account credentials and reset krbtgt twice
Workarounds
- Restrict network access to the PaperCut web interface and XML-RPC endpoints to trusted management networks
Longer-term hardening
- Run PaperCut under a least-privilege service account instead of SYSTEM
- Monitor for registry hive export (reg save HKLM\SECURITY / SYSTEM), LSASS access and DCSync replication requests
- Patch noPac (CVE-2021-42278/42287) and enforce machine-account-quota hardening
- Place a WAF in front of print management servers
CVEs associated with AI-Agent-Driven Exploitation of PaperCut NG/MF
Weaknesses (CWE) in AI-Agent-Driven Exploitation of PaperCut NG/MF
Timeline of AI-Agent-Driven Exploitation of PaperCut NG/MF
- Huntress observes in-the-wild exploitation of PaperCut NG/MF in customer environments.
- PaperCut publishes an urgent security bulletin acknowledging active exploitation; first compromise reported at an education-sector organization.
- CVE-2026-81578 (CVSS 8.8) and CVE-2026-82078 (CVSS 9.4) identifiers and scores assigned; emergency patches issued.
- Operator at 45.142.193.132 begins AI-driven exploit development in a self-hosted lab (14:44 UTC recon); first RCE on a real target in Australia at 18:39 UTC, under four hours from an empty workspace; domain admin validated ~21:00 UTC.
- CISA reported to have added both CVEs to the Known Exploited Vulnerabilities catalog (one outlet places KEV listing earlier in September).
- At ~08:30 UTC the full campaign launches; 11 organizations compromised in 26 seconds. PaperCut ships Emergency Patch Release 3 (24.1.10, 25.0.13, 26.0.5) after bypasses of earlier fixes.
- By Sep 1-2 the actor has compromised 440 instances across 395 organizations in 48 countries; 12 reach domain admin.
- GreyNoise, Hunt.io and Blackpoint Cyber research on the AI-orchestrated campaign is published, with exposed operator workspace analysis.
- GBHackers publishes further coverage detailing the Windows credential theft and exposed infrastructure.
Sources cited for AI-Agent-Driven Exploitation of PaperCut NG/MF
- Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF (GreyNoise)
- Hackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials (GBHackers)
- PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances (The Hacker News)
- AI-powered attack exploited PaperCut flaws to hack 395 organizations (BleepingComputer)
- AI agents exploited PaperCut flaws to breach 395 organizations (Help Net Security)
- PaperCut MF/NG flaws attacked with hundreds of AI agents (SC Media)
- AI agents used in PaperCut attacks on 395 organizations (GovInfoSecurity)
- PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE (Huntress)
- PaperCut releases second emergency patch for exploited flaws (BleepingComputer)
- Beazley Security Advisory BSL-A1200 (PaperCut NG/MF)
- The Register: PaperCut AI agent campaign
Detection coverage for TL-2026-3740
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3740 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.