Hackers Exploit PaperCut NG/MF Flaws to Steal Credentials and Deploy Meterpreter

Threat actors are actively exploiting two critical vulnerabilities in PaperCut NG/MF, identified as CVE-2026-81578 and CVE-2026-82078.

These exploits allow attackers to take control of print management servers, steal credentials, and deploy Meterpreter payloads within enterprise networks.

Analysts Jens Pose and Ross Phillips from Arctic Wolf reported that these intrusions progressed from remote command execution to reconnaissance, credential collection, and attempts to create privileged accounts.

This situation highlights the risks associated with internet-exposed PaperCut infrastructure, which has been previously exploited to deliver LockBit ransomware through vulnerabilities in earlier campaigns.

PaperCut NG/MF Flaws

On August 27, 2026, PaperCut disclosed that these vulnerabilities were being actively exploited. Identifiers were assigned the following day, and the Cybersecurity and Infrastructure Security Agency (CISA) added both issues to its Known Exploited Vulnerabilities catalog on August 31.

Arctic Wolf’s telemetry indicates that operators executed basic host profiling commands, such as `uname`, `whoami`, `ver`, and `tasklist`, after compromising systems.

They also attempted to create a privileged local account named Administrator17, which could provide a stable administrative foothold even if defenders blocked the initial web access method.

Investigators detected inbound GET requests from the IP address 45.142.193.132, targeting the paths `/custom/pcp_*.txt` and `/custom/web/pcp_*.txt` on compromised systems.

These files contained harvested system and user data, suggesting that attackers were using the PaperCut server to collect and retrieve this information.

The same infrastructure also delivered `lsa_collect.exe`, `lsa_collect_small.exe`, and `save_hives.exe` through `certutil`. Sandbox analysis revealed that `lsa_collect.exe` was extracting registry keys necessary to reconstruct the Windows BootKey.

This step can unlock access to the SAM database, facilitating offline password-cracking operations during attacks.

Additionally, threat actors downloaded Java Meterpreter components from the IP address 194.180.48.134 and established sessions back to that host. One of the retrieved objects was found under a `Metasploit/Meterpreter JarFileClassLoader.class` path, indicating an effort to maintain interactive control after exploitation.

The operators then searched for sensitive terms, such as “password,” “secret,” “ldap,” “bind,” and “token,” within PaperCut’s configuration files (`*.config`).

This sequence of actions combines rapid discovery, credential theft, configuration mining, and remote access tooling into a highly scalable compromise chain.

Defenders should inspect the PaperCut `server.log` for exploitation strings, including `jdbc:derby:memory:pwn;create=true`, DatabaseUtils errors involving `VALUES CAST`, `jdbc:no:x`, and `VALUES CAST(X’cafebabe` markers.

Security teams should also look for unusually short, five-character files with extensions such as `.class`, `.cmd`, or `.out` in PaperCut directories.

Endpoint detections should flag instances of `pc-app.exe` launching `cmd.exe`, PowerShell, or other interpreters, while preserving full command lines and network connections for further analysis. Searches for `pc-app.exe`-parented executions of `whoami`, `tasklist`, `ver`, or `uname -a` can help quickly identify previously overlooked hands-on-keyboard activity.

Response teams should examine endpoint telemetry for the presence of `lsa_collect.exe`, `lsa_collect_small.exe`, and `save_hives.exe`, along with their SHA-256 hashes.

They should also review account management logs for any signs of the creation of the Administrator17 account or of other unexpected administrator accounts that appeared shortly after PaperCut detected anomalous behavior. Web and file access logs may reveal requests for pcp text files, large downloads, and the `python-requests/2.32.5` user agent.

Organizations are encouraged to limit direct internet access to PaperCut management interfaces, apply vendor-recommended fixes, block known malicious infrastructure, and investigate exposed servers for any signs of persistence, stolen credentials, and lateral movement.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.