Paper Cut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
Summary: A suspected Russian-speaking actor used hundreds of AI agents built on OpenAI Codex, a DeepSeek model, and offensive tools including Mimikatz, SharpHound, Certipy, Rubeus, and Impacket to compromise at least 440 PaperCut MF/NG instances across 395 victim organizations in 48 countries, exploiting an authentication bypass and remote code execution chain tracked as CVE-2026-81578 and CVE-2026-82078. GreyNoise reported the attacker went from an empty workspace to remote code execution against a real victim in under four hours, compromised at least 11 organizations in 26 seconds, and reached full domain administrator access at a U.S. high school seven minutes after initial access.
Key Takeaway: The actor explicitly tried to spare 28 countries, including Russia and China, and that restraint failed in some cases - a targeting pipeline that granular is now cheap enough to build from an empty workspace in hours. Blackpoint's assessment is that the real gain was not a novel exploit but the collapse in human effort to research, debug, classify, and retry against hundreds of live systems.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-81578CVE-2026-82078
- Related