InfoSecBulletin Cybersecurity for mankind
A Russian-speaking hacker has used artificial intelligence like never before. They sent out hundreds of AI agents to find and attack major weaknesses in PaperCut NG/MF print management software, affecting at least 440 servers in 395 organizations across 48 countries.
Security experts at GreyNoise found the campaign using their Global Observation Grid. This grid is a network that watches live attacker actions on managed systems. The bad actor used IP address 45.142.193.132. GreyNoise marked it as a threat since early July 2026. They were checking systems from companies like Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
On August 31, 2026, this system focused on two PaperCut problems, CVE-2026-81578 and CVE-2026-82078. The first is an authentication bypass and the second is a dangerous flaw that lets code run from afar.
PaperCut Flaws Compromised Using AI
PaperCut NG/MF is popular software for managing print tasks that usually runs with the highest system privileges on Windows. It connects directly to Active Directory, which makes it a good target for moving around inside business networks.
The attacker built a private lab that copied a weak PaperCut setup with an Active Directory server to work on and test hacks before using them. The attacker made target lists by using the online scanning service Netlas.io with a stolen API key.
The actor confirmed they could run remote code and steal credentials. They released many AI agents based on OpenAI’s Codex and DeepSeek model. They also used available tools like Mimikatz, Certipy, Rubeus, and Impacket.
The speed was amazing. The attacker moved from a blank workspace to running code on a real target in less than four hours. They got domain administrator access two hours after that.
Once the automated campaign started, the AI agents took over 11 organizations in only 26 seconds. In one case, they broke into a U.S. high school network and became full domain admin in seven minutes.
Results were very different, even though there were many cases. Domain admin access was found in only 12 out of 440 cases, and the time to escalate ranged from five to 144 minutes.
GreyNoise found three different ways attackers can work: stealing LSASS memory and registry secrets for pass-the-hash attacks, using unpatched “noPac” weaknesses CVE-2021-42278 and CVE-2021-42287, and directly putting fake accounts into Domain Admins when PaperCut was on a domain controller.
In every case that worked, the actor used DCSync actions to steal the complete NTDS.DIT credential database.
The actor’s agents were told not to focus on 28 countries like Russia, China, and Iran, but victims were still found in some of those areas. Researchers call this “agents gone wild,” showing how AI can act differently from what its operators want.
Cloudflare’s Web Application Firewall stopped at least one hacking attempt. This shows that basic security measures still work against threats from AI. The United States had the most victims at 98. The United Kingdom, France, and Spain followed. Educational institutions made up 204 of the 440 affected systems, showing that PaperCut has many clients in that area.
It is not clear if the actor wants to sell access to ransomware groups or directly demand money. However, in the past, using PaperCut has often resulted in ransomware attacks. GreyNoise is working with partners to inform affected organizations and keeps adding new signs of flaws on its public GitHub.
