InfoSecBulletin Cybersecurity for mankind
A Russian-speaking hacker has used artificial intelligence like never before. They sent out hundreds of AI agents to find and attack major weaknesses in PaperCut NG/MF print management software, affecting at least 440 servers in 395 organizations across 48 countries.
Security experts at GreyNoise found the campaign using their Global Observation Grid. This grid is a network that watches live attacker actions on managed systems. The bad actor used IP address 45.142.193.132. GreyNoise marked it as a threat since early July 2026. They were checking systems from companies like Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
On August 31, 2026, this system focused on two PaperCut problems, CVE-2026-81578 and CVE-2026-82078. The first is an authentication bypass and the second is a dangerous flaw that lets code run from afar.
PaperCut Flaws Compromised Using AI
PaperCut NG/MF is popular software for managing print tasks that usually runs with the highest system privileges on Windows. It connects directly to Active Directory, which makes it a good target for moving around inside business networks.
The attacker built a private lab that copied a weak PaperCut setup with an Active Directory server to work on and test hacks before using them. The attacker made target lists by using the online scanning service Netlas.io with a stolen API key.
The actor confirmed they could run remote code and steal credentials. They released many AI agents based on OpenAI’s Codex and DeepSeek model. They also used available tools like Mimikatz, Certipy, Rubeus, and Impacket.
The speed was amazing. The attacker moved from a blank workspace to running code on a real target in less than four hours. They got domain administrator access two hours after that.
Once the automated campaign started, the AI agents took over 11 organizations in only 26 seconds. In one case, they broke into a U.S. high school network and became full domain admin in seven minutes.
Results were very different, even though there were many cases. Domain admin access was found in only 12 out of 440 cases, and the time to escalate ranged from five to 144 minutes.
GreyNoise found three different ways attackers can work: stealing LSASS memory and registry secrets for pass-the-hash attacks, using unpatched “noPac” weaknesses CVE-2021-42278 and CVE-2021-42287, and directly putting fake accounts into Domain Admins when PaperCut was on a domain controller.
In every case that worked, the actor used DCSync actions to steal the complete NTDS.DIT credential database.
The actor’s agents were told not to focus on 28 countries like Russia, China, and Iran, but victims were still found in some of those areas. Researchers call this “agents gone wild,” showing how AI can act differently from what its operators want.
Cloudflare’s Web Application Firewall stopped at least one hacking attempt. This shows that basic security measures still work against threats from AI. The United States had the most victims at 98. The United Kingdom, France, and Spain followed. Educational institutions made up 204 of the 440 affected systems, showing that PaperCut has many clients in that area.
It is not clear if the actor wants to sell access to ransomware groups or directly demand money. However, in the past, using PaperCut has often resulted in ransomware attacks. GreyNoise is working with partners to inform affected organizations and keeps adding new signs of flaws on its public GitHub.
