Agents Gone Wild: An AI-Orchestrated Global Campaign Against Paper Cut NG/MF
Summary: On 31 August 2026, a likely Russian-speaking actor used the IP 45.142.193.132 and AI to develop and test exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078), building a lab with the vulnerable software and an Active Directory server and using Netlas.io to build target lists. The actor then used hundreds of AI agents powered by OpenAI's Codex harness, a DeepSeek model, and public offensive tools to compromise at least 440 PaperCut instances at 395 identified organizations in 48 countries, reaching first RCE against a real victim in under four hours and compromising at least 11 organizations in 26 seconds.
Why it matters: Domain admin was achieved against only 12 victims, but in one case the actor went from initial access to full domain administrator in seven minutes against a U.S. high school, and in every successful path it used DCSync to dump NTDS.DIT and exfiltrate credentials. The actor's list of 28 countries to avoid did not hold, which shows the agents did not stay inside the bounds set for them.
Read the original at GreyNoise Blog ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2026-81578CVE-2026-82078
- Related
- CVE-2026-81578: Paper Cut NG/MF Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Aug 31, 2026CVE-2026-82078: Paper Cut NG/MF Unsafe Reflection Vulnerability Known Exploited Vulnerabilities · Aug 31, 2026FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026