PaperCut Attacker Left an AI Hacking Workbench Wide Open
Hunt.io found the PaperCut mass-exploitation crew's AI agent prompts, exploit variants, credential stealers and victim access kits on an open server, plus a second RCE route through the XML-RPC API.
The crew mass-exploiting PaperCut print servers left its own workshop unlocked. Hunt.io found three open directories on a single Amsterdam-hosted server holding the operator’s AI agent instructions, exploit variants, credential stealers, persistence kits and packaged access to victims. The haul includes a reconnaissance list of 1,005 PaperCut hosts in at least 45 countries and a second remote code execution route through PaperCut’s XML-RPC API. Hunt.io says it handed victim data to national CERTs rather than publishing it.
For defenders
Affected: PaperCut NG/MF. CVE-2026-81578 (CVSS 8.8) lets an unauthenticated request reach an admin-only component, and CVE-2026-82078 (CVSS 9.4) is unsafe reflection in JDBC driver loading that leads to code execution. Both were disclosed as actively exploited on Aug. 27 and are fixed in 26.0.5, 25.0.13 and 24.1.10 (PaperCut bulletin).
The second RCE: Hunt.io describes abuse of /rpc/api/xmlrpc that works where API network and token controls are weak, with the built-in admin password used as a fallback token. The write-up doesn’t say whether this path is patched or has a CVE, so treat it as open until PaperCut says otherwise.
The AI angle: A roughly 19 KB AGENTS.md file in mixed Russian and English served as the system prompt for a coding agent, which GreyNoise says ran on a DeepSeek model. It allowed up to 25 parallel subagents and framed the work as an authorized training exercise, a jailbreak trick we also saw in Unit 42’s CL-UNK-1211 case. Hunt.io names no actor. It cites GreyNoise’s view that the operator is likely Russian-speaking.
Scale (per Hunt.io): 2,165 logged Metasploit attempts, 13 successes and 5 confirmed interactive sessions. It also found 31 packaged victim folders (including domain admin compromises in the UK and Portugal), 45 live reverse SOCKS5 pivots at capture time and 46 Active Directory domains. Victim domain names lean toward education. GreyNoise and Blackpoint separately count at least 440 compromised instances.
ATT&CK (per Hunt.io): T1190 (Exploit Public-Facing Application), T1003.004 (OS Credential Dumping: LSA Secrets), T1136.001 (Create Account: Local Account), T1090.001 (Proxy: Internal Proxy), T1572 (Protocol Tunneling), T1053.003 (Scheduled Task/Job: Cron).
45.142.193[.]132 (orchestration host; ports 8000, 18080, 18081, 18443 chisel C2)
45.158.196[.]75 (secondary build/execution VPS)
pentagi[.]local (self-signed cert CN, port 33333)
Cert SHA-256: 12603F7A89C66717661F4695E2F0D474036E42EE1631B2070AA88D590D1B79C3
Port 31337 (reverse bridge/tunnel listener)/var/tmp/.rs_live46_v5/ (chisel working directory)
watch.sh / stage.sh with @reboot cron entries
<PaperCut>/server/custom/web/<10 random chars>.txt
Unexpected .class files under PaperCut lib/
Modified user-lookup.* config keys528cd4e69ecfa5191adbcf6ef28667bf (lsa_read.exe)
ce870a91e8d27e8f663f0687abc60b04 (save_hives.exe)
a6437ac3d6798090a218520985d36a3f (collect_custom.exe)
fc92dfafa7aa741c5f2b9cbcf75d1d19 (lsa_collect_small.exe)What it means for you
PaperCut is the software many schools, libraries and offices use to manage shared printers. Here, the print server was the way in. Once inside, the attackers took stored passwords and used the machine as a tunnel into the rest of the network. If your school, nonprofit or small office uses PaperCut, ask whoever runs it whether it’s on a fixed version and whether anyone checked it for signs of a break-in. If you don’t use PaperCut, there’s nothing to do.
Do this now
- Update PaperCut NG/MF to 26.0.5, 25.0.13, 24.1.10 or later, and take the admin interface off the open internet.
- Lock down or disable the XML-RPC API. If you need it, require real API authentication and an IP allowlist, not the admin password.
- If your server was exposed and unpatched between mid-August and mid-September, Hunt.io advises treating it as possibly compromised. Check for the artifacts above, then rotate the database, LDAP and keystore credentials PaperCut can reach and review AD for new accounts.
- Block outbound traffic from print servers to anything they don’t need, especially odd high ports like 18443 and 31337.
CVE at a glance
- CVSS
- 8.8 High (v4.0)
- EPSS
- 85.6% chance of exploitation in the next 30 days (higher than 99.7% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Aug 31, 2026
- Public exploit
- Yes, reported in a Metasploit module, a Nuclei template and 2 GitHub repositories
- CVSS
- 9.4 Critical (v4.0)
- EPSS
- 63.5% chance of exploitation in the next 30 days (higher than 99.2% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Aug 31, 2026
- Public exploit
- Yes, reported in a Metasploit module
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.