A threat actor built a working exploit for PaperCut print management software, then handed the job of breaking into hundreds of organizations to AI agents that did most of the work on their own, according to GreyNoise.
The result was at least 440 compromised PaperCut instances across 395 identified organizations in 48 countries.
Attacker, believed to be Russian-speaking, first built a private lab environment with a vulnerable copy of PaperCut NG/MF and an Active Directory server to develop and test exploits for two vulnerabilities, tracked as CVE-2026-81578 and CVE-2026-82078.
“As part of the adversary’s exploit development and testing, they built and attacked a lab environment that included the vulnerable PaperCut software and an Active Directory server. In parallel workflows, the adversary built target lists using an internet scanning service Netlas.io using an identified API key,” researchers explained.
The agents ran on OpenAI’s Codex harness paired with a DeepSeek model, along with publicly available offensive security tools.
Help Net Security reported that PaperCut Software confirmed exploitation of the two vulnerabilities in late August and released emergency patches, urging customers to restrict access to the Application Server from the public internet.
AI agents accelerate PaperCut compromises
GreyNoise says the attacker went from an empty workspace to remote code execution against a real victim in under four hours, and reached domain administrator rights two hours after that.
“AI enables fast and efficient complex orchestration of cyber operations,” the researchers wrote, adding that such operations can also drift from what the attacker intended once left running on their own.
The attacker worked from a list of 28 countries to avoid, most of them in the former Soviet region, alongside countries such as Brazil, Turkey, Nigeria, and South Africa. GreyNoise found victims in several of those excluded countries anyway, including Russia, China, Kazakhstan, and Pakistan, in what the researchers describe as a case of “agents gone wild,” where the automated tooling deviated from its own operator’s instructions.
Once the automated campaign was underway, GreyNoise recorded 11 organizations compromised in 26 seconds. In one case, a high school in the United States went from initial access to domain admin in seven minutes. Where the attacker did get domain admin rights, the fastest run took five minutes and the slowest took 144 minutes.
The agents were not equally successful everywhere. GreyNoise counted 280 victims where credentials were harvested and 147 where operating system or domain secrets were pulled, but domain admin rights were only achieved against 12 organizations.
Education accounts for most victims
Education was the most affected sector by a wide margin, with 204 victims, something GreyNoise attributes to PaperCut’s customer base rather than deliberate targeting. Retail, professional services, and hospitality organizations followed, along with a scattering of government, healthcare, and legal victims.
By country, the United States recorded the most victims at 98, followed by the United Kingdom, France, Spain, and Canada.
“It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses to achieve follow-on objectives such as data theft or ransomware deployment,” GreyNoise noted.
GreyNoise says it will keep monitoring the campaign and publish updated indicators of compromise as they emerge.