In a significant cyberattack, a coordinated effort involving hundreds of AI agents targeted PaperCut NG and MF print management systems, leading to the compromise of 440 servers across 395 organizations in 48 countries, as reported by GreyNoise. This campaign utilized OpenAI’s Codex and DeepSeek models alongside standard security tools to identify and exploit vulnerabilities.
AI Agents and Vulnerability Exploitation
The attackers leveraged AI-driven tools to expedite the exploitation process, highlighting the potential for AI to accelerate complex cyber intrusions. Despite the sophistication of AI, the breach was facilitated by existing vulnerabilities and inadequate system protection. Compromised servers were instrumental in gathering credentials and accessing internal networks, showing the critical nature of robust security.
Hunt.io’s investigation revealed directories containing the hacker’s instructions, exploit codes, and logs, demonstrating a structured and automated attack approach. The operation exploited two key vulnerabilities in PaperCut NG/MF: CVE-2026-81578, which allows unauthorized settings changes, and CVE-2026-82078, a flaw that enables code execution through unsafe class-loading.
Rapid Expansion and System Breach
GreyNoise documented the attack’s rapid progression from testing to targeting real systems, with the first breach occurring in under four hours. The attackers quickly moved to compromise multiple organizations, demonstrating the efficiency of their methods. Hunt.io found evidence of an automated process with various exploit variants designed for different system conditions, including an alternative route through XML-RPC when API controls were weak.
The attackers’ methods included collecting Windows registry data and creating reverse SOCKS tunnels to further penetrate networks. These tactics underscore the need for vigilant monitoring of network activity and the importance of securing all potential entry points.
Defensive Measures and Future Outlook
Defenders are advised to upgrade to the latest PaperCut security releases and review guidelines to mitigate these vulnerabilities. Limiting public access to management interfaces and enforcing strong authentication measures are crucial steps. Additionally, organizations should scrutinize logs for unusual activity and address any unauthorized changes to system settings.
Hunt.io’s findings, which included a list of 1,005 hosts potentially vulnerable, emphasize the ongoing threat and the need for proactive security measures. By understanding the extent and methods of such attacks, organizations can better prepare and fortify their defenses against future breaches.
As cyber threats evolve, maintaining up-to-date defenses and integrating threat intelligence feeds will be essential in protecting against new malware and exploits. Continuous vigilance and prompt action are vital in safeguarding sensitive data and ensuring network integrity.
