Hackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials

A likely Russian-speaking threat actor used hundreds of AI agents to exploit PaperCut NG/MF servers, steal Windows credentials and establish reusable access to internal networks.

GreyNoise identified at least 440 compromised instances belonging to 395 organizations across 48 countries, demonstrating how agent-assisted workflows can accelerate exploitation of enterprise infrastructure.

The operator combined OpenAI’s Codex harness with a DeepSeek model, not an OpenAI model, and publicly available offensive tools.

Hunt.io’s investigation, detailed in the supplied research, identified exposed directories on ports 8000, 18080 and 18081 of 45.142.193[.]132.

Their contents included exploit scripts, AI-agent instructions, vulnerability assessments, credential collectors, Metasploit logs and packaged victim environments.

The largest directory contained 1,924 files across 97 subdirectories, totaling approximately 3.9 GB.

Blackpoint Cyber’s analysis independently documented an iterative development workflow in the exposed tooling. Timestamped state files preserved failures, code changes, unfinished tasks and retry decisions.

Rather than generating isolated exploits, AI assistance helped maintain an operational loop spanning research, debugging, target classification and repeated execution.

The primary attack chained CVE-2026-81578, an authentication bypass rated CVSS 8.8, with CVE-2026-82078, an unsafe dynamic class-loading vulnerability rated 9.4.

Together, the flaws allowed unauthenticated configuration manipulation followed by arbitrary Java bytecode execution within the PaperCut service process.

Hunt.io observed the campaign, progress from an empty workspace to real-world remote code execution in under four hours. During a subsequent wave, the actor compromised 11 organizations in 26 seconds.

Recovered scripts modified external user-lookup settings and selected execution techniques according to the installed version.

AI Agents Target PaperCut

PaperCut 26.x targets faced H2/Groovy-based execution, while earlier versions were targeted through Apache Derby mechanisms.

Another variant retrieved command output through temporary files beneath PaperCut’s web directory, avoiding dependence on outbound callbacks.

The supplied research also describes an independent XML-RPC attack path.

Where API network restrictions or authentication controls were weak, configuration-writing and card-lookup methods could enable execution without the original Tapestry bypass. API reachability alone, however, did not establish successful exploitation.

Post-exploitation utilities collected Windows SECURITY and SYSTEM registry data, enabling offline recovery of machine-account secrets.

Additional scripts searched configuration files and logs for LDAP bind passwords, database credentials and service-account secrets.

Reverse SOCKS tooling converted compromised servers into internal network pivots, while Linux deployments used chisel and cron for persistence.

The operator packaged credentials, domain information and proxy configurations into victim-specific archives. According to the recovered artifacts, 45 targets had working reverse SOCKS5 pivots at capture.

Separate Metasploit logs contained 2,165 attempts and five confirmed interactive sessions; these figures describe that dataset, not the campaign’s total compromises.

GreyNoise’s investigation documented domain-administrator access at 12 organizations and credential harvesting from 280 affected instances.

The researchers emphasized that conventional hardening still disrupted attacks, including one instance where a web application firewall blocked exploitation.

Patching remains urgent. PaperCut’s security bulletin identifies NG/MF 26.0.5, 25.0.13 and 24.1.10 as maintenance releases replacing emergency patches.

Defenders should restrict internet exposure, review XML-RPC controls, investigate suspicious PaperCut child processes and inspect unexpected administrator accounts, registry exports and outbound tunnels.

Suspected compromise requires broader incident response, credential review and clean rebuilding not simply installing an update.

Indicators of Compromise

Indicator	Type	Notes
45.142.193[.]132	IPv4	Primary orchestration host. Open directories on ports 8000, 18080, and 18081.
45.158.196[.]75	IPv4	Secondary build and execution VPS, reached over SSH.
45.142.193[.]132:8000	HTTP	Bulk post-exploitation staging directory
45.142.193[.]132:18080	HTTP	AI agent workbench (pupercut/)
45.142.193[.]132:18081	HTTP	chisel implant staging, not previously published

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.