Eleven organizations compromised in 26 seconds. That is how fast the automated phase of one attack on PaperCut print management software ran, according to GreyNoise, which tracked the campaign.
The attacker, believed to be Russian-speaking, wrote a working exploit and then handed the break-ins to AI agents. The result was at least 440 compromised PaperCut instances across 395 identified organizations in 48 countries. GreyNoise says there are other victims it could not tie to a named organization.
A lab, a target list, a fast start
The two flaws are tracked as CVE-2026-81578 and CVE-2026-82078, and both affect PaperCut NG/MF. To develop the exploit, the attacker built a private lab with a vulnerable copy of the software and an Active Directory server. “In parallel workflows, the adversary built target lists using an internet scanning service Netlas.io using an identified API key,” the researchers wrote.
The agents ran on OpenAI’s Codex harness paired with a DeepSeek model, along with publicly available offensive security tools. From an empty workspace, the attacker reached remote code execution against a real victim in under four hours, and reached domain administrator rights two hours after that. At one high school in the United States, the gap between first access and domain admin was seven minutes. Where domain admin was won, the fastest run took five minutes and the slowest 144.
PaperCut Software confirmed exploitation of the two flaws in late August and released emergency patches. It urged customers to keep the Application Server off the public internet.
Agents gone wild
The attacker kept a list of 28 countries to avoid, mostly in the former Soviet region but also including Brazil, Turkey, Nigeria and South Africa. The agents ignored it. GreyNoise found victims in Russia, China, Kazakhstan and Pakistan, and described it as a case of “agents gone wild,” automated tooling straying from its operator’s instructions. “AI enables fast and efficient complex orchestration of cyber operations,” the researchers wrote, adding that such operations can drift once left running.
They were not equally successful everywhere. Credentials were harvested at 280 victims and operating system or domain secrets pulled at 147, but domain admin rights were achieved at only 12 organizations.
Education took the worst of it, with 204 victims, something GreyNoise attributes to PaperCut’s customer base rather than deliberate targeting. Retail, professional services and hospitality followed, along with a few government, healthcare and legal victims. The United States recorded the most victims at 98, ahead of the United Kingdom, France, Spain and Canada.
Nobody knows yet what the attacker wants. “It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses to achieve follow-on objectives such as data theft or ransomware deployment,” GreyNoise said. It will keep monitoring the campaign and publish updated indicators of compromise.
