# AI-Agent-Driven Exploitation of PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) Leads to Windows Credential Theft and Domain Admin Compromise

> A likely Russian-speaking operator used hundreds of AI agents (OpenAI's Codex harness driving a DeepSeek model) to chain two PaperCut NG/MF flaws, compromising at least 440 instances across 395 organizations in 48 countries. Post-exploitation focused on Windows credential harvesting, reverse proxying/tunneling and Active Directory abuse, reaching domain administrator at 12 organizations.

- **Published:** 2026-10-16T12:40:14Z
- **Last reviewed:** 2026-10-16T12:40:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3740
- **ID:** TL-2026-3740
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-81578, CVE-2026-82078

## Description

CVE-2026-81578 (CVSS 8.8) is an authentication bypass in the PaperCut NG/MF web management interface: unauthenticated requests to administrative functions trigger backend actions before access validation. CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class-loading flaw in PaperCut's database connection utilities, which load database driver classes from configurable driver names without an allowlist. Chained, they give pre-authentication remote code execution; PaperCut runs as a Java web application, frequently with SYSTEM-level privileges on Windows. Public sources describe execution via H2/Groovy on 26.x and Apache Derby on earlier versions, with command output retrieved through temporary files in PaperCut's web directory, plus an XML-RPC alternative path. (Note: some secondary outlets describe the two CVEs differently, e.g. as pre-auth RCE and post-auth sandbox escape; the primary-vendor/GreyNoise descriptions above are used here.)

PaperCut issued an urgent bulletin on 2026-08-27 after exploitation was seen in customer environments from about 2026-08-26 (Huntress). CVE IDs and scores were assigned 2026-08-28, and Emergency Patch Releases followed, with a third release on 2026-09-01 (24.1.10, 25.0.13, 26.0.5) after bypass paths against earlier fixes were found. Both CVEs were reported added to CISA KEV.

On 2026-08-31 an actor operating from 45.142.193.132 began developing and testing exploits in a self-hosted lab with AI agents (Hunt.io observed empty workspace to real-world RCE in under four hours; first RCE on a real target in Australia at 18:39 UTC; domain admin validation about 21:00 UTC). On 2026-09-01 (08:30 UTC) the actor launched the full campaign and compromised 11 organizations in 26 seconds. Target lists were built using Netlas.io with an identified API key, merged through a funnel with geolocation and a 28-country exclusion list (Russia, China, Iran, Venezuela and others) that agents did not consistently honor.

Blackpoint Cyber found the same IP serving an open HTTP directory (ports 8000/18080/18081; ~3.9 GB, 1,924 files) holding the operator's entire workspace: scripts, target lists, state files and failure logs. Tooling included Metasploit/Meterpreter Java payloads (2,165 attempts, 5 interactive sessions), custom Windows utilities (save_hives.exe, lsa_read.exe, collect_custom.exe), Certipy, Mimikatz, SharpHound/BloodHound, Rubeus, Impacket, NetExec, Ligolo-ng, Chisel with cron persistence on Linux, and live_reverse_socks5.py (45 active reverse SOCKS5 pivots at capture). The agent stack also used Hindsight (persistent agent memory) and AionUi (concurrent-agent workspace).

Post-exploitation harvested Windows SECURITY/SYSTEM registry hives, LSA secrets, LDAP bind passwords, and database/service-account credentials (280 victims credential theft; 147 with OS/domain secrets). Three domain-admin paths were used: LSASS/registry dumping with pass-the-hash, noPac (CVE-2021-42278/42287), and direct Domain Admins group addition via compromised service accounts, followed by DCSync. Domain admin was achieved at 12 organizations, in 5 to 144 minutes (7 minutes at a US high school). Education was the primary sector (204 victims, ~46-50%). The end goal is unconfirmed (possible access brokering, ransomware or data theft). Cloudflare WAF blocked exploitation in at least one case.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1596.005 Scan Databases
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1053.003 Cron
- T1136.002 Domain Account
- T1003.002 Security Account Manager
- T1003.004 LSA Secrets
- T1003.001 LSASS Memory
- T1003.006 DCSync
- T1552.001 Credentials In Files
- T1087.002 Domain Account
- T1550.002 Pass the Hash
- T1090 Proxy
- T1572 Protocol Tunneling
- T1588.002 Tool

## Sources

- [Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF (GreyNoise)](https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf)
- [Hackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials (GBHackers)](https://gbhackers.com/ai-agents-target-papercut/)
- [PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances (The Hacker News)](https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html)
- [AI-powered attack exploited PaperCut flaws to hack 395 organizations (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations/)
- [AI agents exploited PaperCut flaws to breach 395 organizations (Help Net Security)](https://www.helpnetsecurity.com/2026/09/11/ai-agents-papercut-ng-mf-attack-campaign/)
- [PaperCut MF/NG flaws attacked with hundreds of AI agents (SC Media)](https://www.scworld.com/news/papercut-mfng-flaws-attacked-with-hundreds-of-ai-agents)
- [AI agents used in PaperCut attacks on 395 organizations (GovInfoSecurity)](https://www.govinfosecurity.com/ai-agents-used-in-papercut-attacks-on-395-organizations-a-32801)
- [PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE (Huntress)](https://www.huntress.com/blog/papercut-actively-exploited)
- [PaperCut releases second emergency patch for exploited flaws (BleepingComputer)](https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/)
- [Beazley Security Advisory BSL-A1200 (PaperCut NG/MF)](https://labs.beazley.security/advisories/BSL-A1200)
- [The Register: PaperCut AI agent campaign](https://www.theregister.com/a/5295650)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3740