LONDON, September 13 — A suspected Russian-speaking cyber actor has been caught using artificial intelligence to build working exploits against a freshly disclosed pair of PaperCut NG/MF security flaws, breaking into hundreds of exposed instances in what threat intelligence firms describe as an AI-assisted attack pipeline. The activity has been traced to a single IP address, 45.142.193[.]132, which independent reports from Blackpoint Cyber and GreyNoise link to unauthorized port scanning and brute-force attempts in recent weeks. Arctic Wolf flagged the same address in connection with the exploitation activity last week.
What’s changing here isn’t the vulnerability. It’s the workflow wrapped around it.
A lab, a target list, and a feedback loop
At the core sit CVE-2026-81578 and CVE-2026-82078 — an authentication bypass chained to remote code execution. The campaign has mainly targeted the education sector across the U.S., the U.K., France, Spain, Canada, Belgium, Portugal, Australia, Germany and Switzerland. GreyNoise said the adversary built and attacked a lab environment containing the vulnerable PaperCut software and an Active Directory server as part of exploit development and testing.
In parallel, the actor assembled target lists using the internet scanning service Netlas.io with an identified API key. Blackpoint traced the operation back to exposed operator infrastructure that lays out the AI-assisted workflow end to end — from vulnerability research and exploit development through target filtering, failure analysis, code changes and repeated retry waves.
“The earliest recovered activity began on August 31, with the project focused on vulnerability research and comparing patched and unpatched PaperCut builds,” wrote Nevan Beal, principal MDR analyst at Blackpoint, alongside security researcher Sam Decker.
“Within hours, that research had been turned into a multi-threaded validation tool that was reviewed, tested, and run against progressively larger target sets.” The targeting pipeline itself is recovered source code: a funnel that merges multiple source lists, geolocates candidates, filters them by country, applies an exclusion policy and identifies live PaperCut systems before moving on. Targets are then sorted by operating system and environment, with separate lists for active, unreachable, stage-missing, post-exploitation-eligible and retry-pending systems — rather than treating every failure as the same problem.
Python scripts track the later stages and confirm they actually completed: administrator access, account verification, Active Directory collection, domain and network discovery, proxy setup. Failures get recorded, and the framework adapts.
Speed that resets the clock
The tempo is the headline. According to GreyNoise, the attacker went from an empty workspace to first achieving remote code execution against a real victim in just under four hours, and compromised at least eleven organizations in twenty-six seconds once the campaign began in earnest. In one attack on a U.S. high school, the gap between initial access and full domain administrator access was seven minutes.
Once inside its self-hosted lab, the actor moved to credential harvesting and then unleashed hundreds of AI agents — powered by OpenAI Codex, a DeepSeek model, and publicly available offensive security tools including Mimikatz, SharpHound, Certipy, Rubeus and Impacket — against no fewer than 440 PaperCut MF/NG instances hosted by 395 identified victim organizations across 48 countries. “There are other real victims that could not be attributed to a named organization,” GreyNoise added.
Observed post-exploitation activity, Arctic Wolf noted, included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes and sensitive configuration data. GreyNoise has tracked malicious use of the address since early July 2026 for probing internet-facing systems from several vendors, among them Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE. The actor also explicitly tried to avoid targeting entities in 28 identified countries — Russia, China, Hong Kong, Thailand, Iran, Venezuela, Indonesia, Pakistan and Bangladesh among them.
“Our observed victimology shows the attempted restraint failed in some instances,” GreyNoise said.
What the actor wanted — and what nobody knows yet
Domain administrator access was achieved against only twelve victim organizations. The end goal remains unclear. “It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses to achieve follow-on objectives such as data theft or ransomware deployment,” GreyNoise said.
Blackpoint’s Beal was equally careful. “At this time, we cannot confirm the exact end goal of this campaign,” he told The Hacker News.
“The threat actor’s methodology is consistent with initial-access activity, but we do not yet have sufficient evidence to confirm whether they are operating as an initial access broker.”
The trend underneath is the one to watch. AI is the fulcrum the entire architecture revolves around, turning vulnerability research into an exploitation pipeline through a persistent feedback loop that informs every cycle.
