🚨 AI-ORCHESTRATED PAPERCUT CAMPAIGN — 440 INSTANCES COMPROMISED GreyNoise says a likely Russian-speaking actor used AI-assisted workflows to develop, test, and operationalize exploits against PaperCut NG/MF on August 31, 2026. The campaign targeted CVE-2026-81578 and CVE-2026-82078 and moved from exploit development to global compromise at remarkable speed. Key numbers: * 440 PaperCut NG/MF instances compromised * 395 identified victim organizations * 48 countries impacted * 280 victims had credential harvesting activity * 147 had OS or domain secrets accessed * 12 organizations reached Domain Admin compromise * 204 victims were in the education sector Speed was one of the most notable elements: * Empty workspace → first real-world RCE in under 4 hours * First Domain Admin compromise roughly 2 hours later * At least 11 organizations compromised in 26 seconds once the campaign launched * Fastest observed path to Domain Admin: 5 minutes * One U.S. high school went from initial access to Domain Admin in 7 minutes The actor reportedly used hundreds of AI agents, OpenAI Codex as a harness, a DeepSeek model, and publicly available offensive security tooling to orchestrate reconnaissance, exploitation, credential theft, and lateral movement in parallel. Where Domain Admin was achieved, GreyNoise observed three main paths: * Harvesting LSASS and registry secrets from domain-joined PaperCut hosts, followed by pass-the-hash * Exploiting unpatched CVE-2021-42278 / CVE-2021-42287 via noPac * Abusing PaperCut systems already running on domain controllers or under Domain Admin service accounts All successful Domain Admin paths ultimately led to DCSync activity and NTDS.DIT credential extraction. Analyst Note: The important development here is not a new exploitation primitive. It is orchestration. AI allowed the actor to compress reconnaissance, exploit development, credential harvesting, and post-exploitation activity into massively parallel workflows operating at machine speed. But the campaign also reinforces something equally important: traditional defensive controls still matter. GreyNoise observed at least one exploitation attempt blocked by Cloudflare WAF, and basic measures such as patching, segmentation, reduced internet exposure, and Active Directory hardening remain effective. Same vulnerabilities. Much faster adversary. #DDW #CyberSecurity #ThreatIntelligence #AI #PaperCut #AgenticAI #Vulnerability #ActiveDirectory #OSINT
Post summary
GreyNoise reports a rapid, AI‑driven campaign exploiting PaperCut via CVE-2026-81578 and CVE-2026-82078, achieving 440 compromised instances worldwide in minutes, highlighting real‑world exploitation and the continued importance of patching and hardening.
