INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

PaperCut Flaws Exploited by AI-powered Attackers to Hack 835 Orgs

| 2026-09-09 14:56 HIGH HIGH AI-ENABLED ATTACK · AUTONOMOUS EXPLOITED VULNERABILITY ATTACK ON AI SYSTEMS
JSON
Executive Summary
AI-generated
A threat actor, likely Russian-speaking, used hundreds of AI agents to develop and launch a global exploitation campaign targeting vulnerable PaperCut NG/MF servers on August 31. The attackers compromised at least 440 PaperCut instances linked to 395 distinct organizations across 48 countries, with the United States being the most targeted country followed by the UK, France, Spain, and Canada. The AI agents generated target lists through Netlas internet scanning and discovery platform, but did not consistently follow a list of countries to avoid including Russia, China, Iran, Ukraine, Belarus, Moldova, Brazil, and South Africa. The attackers used three attack paths after exploiting PaperCut flaws: dumping LSASS memory and registry secrets from domain-joined servers, passing recovered credential hashes to domain controllers, or directly adding newly created accounts to Domain Admins. As of the article's publication date on September 10, the current status is unclear, but system administrators are advised to apply emergency security updates addressing CVE-2026-81578 and CVE-2026-82078 immediately.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2023-27350, CVE-2026-82078 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 8 IoCs Create Free Account
de•••••.log
nt•••••.dit
ww•••••.io
ud•••••.out
pc•••••.exe
ch•••••.exe
hxxp://••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Raspberry RobinRaspberry Robin CVE-2023-27350CVE-2023-27350 CVE-2026-82078CVE-2026-82078 CVE-2021-42278CVE-2021-42278 CVE-2021-42287CVE-2021-42287 CVE-2026-81578CVE-2026-81578 CVE-2023-27351CVE-2023-27351
Target & Sectors
NORTH_AMERICA NORTH_AMERICA CIS CIS healthhealth educationeducation energyenergy
Incident Timeline
‎April 2023
Threat actors exploited the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in PaperCut print management software to hack 395 organizations.
vulnerability CVE-2023-27350
In April 2023, Microsoft linked the attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to a financially motivated threat actor tracked as Lace Tempest (formerly  DEV-0950 ).
In April 2023, attackers began exploiting the critical CVE-2023-27350 PaperCut vulnerability, which allowed unauthenticated attackers to bypass authentication and remotely execute code on vulnerable servers.
general_metric 27350 -
In April 2023, Microsoft linked the attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to a financially motivated threat actor tracked as Lace Tempest (formerly  DEV-0950 ).
vulnerability CVE-2023-27351
In April 2023, Microsoft linked the attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to a financially motivated threat actor tracked as Lace Tempest (formerly  DEV-0950 ).
organisation Lace Tempest
In April 2023, Microsoft linked the attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to a financially motivated threat actor tracked as Lace Tempest (formerly  DEV-0950 ).
‎April 13, 2023
Threat actors using the Lace Tempest AI-powered attack tool began exploiting previously disclosed PaperCut vulnerabilities on April 13, 2023.
‎May 2023
Microsoft issued a warning in May 2023 that Iran-linked APT groups were exploiting the CVE-2023-27350 flaw in PaperCut MF/NG print management servers.
organisation Microsoft
In May 2023, Microsoft warned that Iran-linked APT groups were exploiting another flaw, tracked as CVE-2023-27350 , in attacks against PaperCut MF/NG print management servers.
source_region Iran, Islamic Republic of
In May 2023, Microsoft warned that Iran-linked APT groups were exploiting another flaw, tracked as CVE-2023-27350 , in attacks against PaperCut MF/NG print management servers.
organisation CVE-2023-27350
In May 2023, Microsoft warned that Iran-linked APT groups were exploiting another flaw, tracked as CVE-2023-27350 , in attacks against PaperCut MF/NG print management servers.
organisation APT
In May 2023, Microsoft warned that Iran-linked APT groups were exploiting another flaw, tracked as CVE-2023-27350 , in attacks against PaperCut MF/NG print management servers.
industry Education
CISA and the FBI  issued a joint advisory in May 2023 warning that the Bl00dy Ransomware Gang was also exploiting vulnerable PaperCut servers in attacks against the education sector.
tactic Ransomware
CISA and the FBI  issued a joint advisory in May 2023 warning that the Bl00dy Ransomware Gang was also exploiting vulnerable PaperCut servers in attacks against the education sector.
attribution FBI
CISA and the FBI  issued a joint advisory in May 2023 warning that the Bl00dy Ransomware Gang was also exploiting vulnerable PaperCut servers in attacks against the education sector.
‎August 27
Threat actors are actively exploiting a pre-authentication remote code execution flaw in PaperCut to hack 395 organizations worldwide.
organisation PaperCut
PaperCut, the print management software running in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers.
tactic Remote Code Execution
PaperCut, the print management software running in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers.
‎2026/08/27
Threat actors used a zero-day vulnerability in PaperCut NG/MF versions 25 and 26 to launch AI-powered attacks against customer servers.
organisation PaperCut NG/MF
As BleepingComputer reported yesterday , PaperCut warned that hackers were exploiting a vulnerability in zero-day attacks against customer servers and released an initial emergency patch for PaperCut NG/MF versions 25 and 26.
organisation BleepingComputer
As BleepingComputer reported yesterday , PaperCut warned that hackers were exploiting a vulnerability in zero-day attacks against customer servers and released an initial emergency patch for PaperCut NG/MF versions 25 and 26.
general_metric 25 versions
As BleepingComputer reported yesterday , PaperCut warned that hackers were exploiting a vulnerability in zero-day attacks against customer servers and released an initial emergency patch for PaperCut NG/MF versions 25 and 26.
‎Aug 28, 2026
Threat actors exploited vulnerabilities in PaperCut's AI-powered security features to successfully hack into the systems of 395 organizations.
‎August 31
GreyNoise reported that an AI-powered attack campaign, combining OpenAI's Codex and DeepSeek models with commodity offensive tools, began on August 31.
attribution GreyNoise
Attack and threat intelligence company GreyNoise says the campaign began on August 31, combining OpenAI’s Codex and DeepSeek models with commodity offensive tools.
attribution OpenAI’s Codex
Attack and threat intelligence company GreyNoise says the campaign began on August 31, combining OpenAI’s Codex and DeepSeek models with commodity offensive tools.
‎2026/09/09
Threat actors exploited vulnerabilities in PaperCut NG and MF print management software, tracked as CVE-2026-82078 and CVE-2026-81578, to hack 395 organizations.
organisation Exploit PaperCut Flaws
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide.
organisation Compromise 440 Servers Worldwide
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide.
victims 395 organizations
GreyNoise data indicates that the operation compromised at least 440 PaperCut instances linked to 395 distinct organizations across 48 countries.
AI-powered attack exploited PaperCut flaws to hack 395 organizations.
organisation GreyNoise
GreyNoise data indicates that the operation compromised at least 440 PaperCut instances linked to 395 distinct organizations across 48 countries.
organisation PaperCut NG/MF
A threat actor, likely Russian-speaking, used hundreds of AI agents to develop and launch a global exploitation campaign targeting vulnerable PaperCut NG/MF servers.
PaperCut has now released emergency patches for customers with public-facing PaperCut NG/MF servers.
organisation LockBit
Those attacks were ultimately linked to numerous threat actors, including the Clop and LockBit ransomware operations , Iranian state-backed hacking groups , and the Bl00dy Ransomware Gang .
" In 2023, a critical flaw in PaperCut MF and NG ( CVE-2023-27350 , CVSS score: 9.8) was exploited by Russian threat actors as well as a financially motivated hacking group called Lace Tempest to deliver Cl0p and LockBit ransomware.
Microsoft also observed intrusions that led to LockBit ransomware attacks.
organisation CVE-2023-27350
" In 2023, a critical flaw in PaperCut MF and NG ( CVE-2023-27350 , CVSS score: 9.8) was exploited by Russian threat actors as well as a financially motivated hacking group called Lace Tempest to deliver Cl0p and LockBit ransomware.
"What we can say: the bulletin advises customers to watch for intrusion-detection, endpoint, or network-monitoring alerts tied to the PaperCut Application Server, and we'll publish indicators of compromise as they're verified." PaperCut servers were previously targeted in 2023 after attackers began exploiting CVE-2023-27350, an authentication bypass and remote code execution vulnerability.
organisation Lace Tempest
" In 2023, a critical flaw in PaperCut MF and NG ( CVE-2023-27350 , CVSS score: 9.8) was exploited by Russian threat actors as well as a financially motivated hacking group called Lace Tempest to deliver Cl0p and LockBit ransomware.
organisation NG
" In 2023, a critical flaw in PaperCut MF and NG ( CVE-2023-27350 , CVSS score: 9.8) was exploited by Russian threat actors as well as a financially motivated hacking group called Lace Tempest to deliver Cl0p and LockBit ransomware.
PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products.
PaperCut warns of NG, MF flaw exploited in zero-day attacks.
organisation CVSS
" In 2023, a critical flaw in PaperCut MF and NG ( CVE-2023-27350 , CVSS score: 9.8) was exploited by Russian threat actors as well as a financially motivated hacking group called Lace Tempest to deliver Cl0p and LockBit ransomware.
organisation Microsoft
Microsoft later linked some of those attacks to the Clop ransomware operation, which exploited vulnerable PaperCut servers for initial access to company networks.
Microsoft said an Iranian state-backed group known for attacking critical infrastructure exploited the same bug that year in multiple attacks.
organisation CVE-2026
System administrators are advised to apply PaperCut’s emergency security updates addressing CVE-2026-81578 and CVE-2026-82078 immediately, and follow the vendor’s recommendations in this bulletin .
PaperCut has now shared technical details and CVE identifiers for the two vulnerabilities, tracked as CVE-2026-82078 and CVE-2026-81578.
infrastructure 8.8
The company released patches for the bugs, tracked as CVE-2026-82078 and CVE-2026-81578,  which both carry severity scores over 8.8 out of 10.
organisation MF
PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products.
PaperCut warns of NG, MF flaw exploited in zero-day attacks.
PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes.
organisation PaperCut NG
“PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.” reads the advisory .
 Ravie Lakshmanan  Aug 28, 2026 Vulnerability / Enterprise Security PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.
“Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG  25.0.11.75758  server.
PaperCut released an emergency advisory on Thursday evening saying vulnerabilities in their print management software, PaperCut NG and MF, are under active exploitation.
PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes.
PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.
organisation PaperCut MF
“PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.” reads the advisory .
 Ravie Lakshmanan  Aug 28, 2026 Vulnerability / Enterprise Security PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.
PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.
organisation CVE-2021-42278
Using the “noPac” attack against environments still vulnerable to CVE-2021-42278 and CVE-2021-42287.
organisation BloodHound
The attacker’s toolkit includes Ligolo-ng, Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, and custom Rust credential-collection utilities.
organisation NetExec
The attacker’s toolkit includes Ligolo-ng, Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, and custom Rust credential-collection utilities.
organisation PaperCut
AI-powered attack exploited PaperCut flaws to hack 395 organizations.
PaperCut warns of hackers using printer management software flaw in attacks.
PaperCut releases second emergency patch for exploited flaws.
PaperCut issued emergency patches on Friday and urged customers to install them immediately.
 Ravie Lakshmanan  Aug 28, 2026 Vulnerability / Enterprise Security PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.
PaperCut warns of NG, MF flaw exploited in zero-day attacks.
organisation Vulnerability / Enterprise Security
 Ravie Lakshmanan  Aug 28, 2026 Vulnerability / Enterprise Security PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.
organisation RCE
“The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds,” GreyNoise notes.
“Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG  25.0.11.75758  server.
Huntress, which has been working with PaperCut during the incident, says it observed exploitation  in two customer environments and reproduced the full pre-authentication RCE chain.
victims 11 organizations
“The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds,” GreyNoise notes.
infrastructure Windows
Emergency Patch Release 2 is available for PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS.
One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver , basic commands to identify the compromised account and Windows version.
The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.
infrastructure Linux
Emergency Patch Release 2 is available for PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS.
infrastructure Macos
Emergency Patch Release 2 is available for PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS.
organisation Domain Admins
Directly adding a newly created account to Domain Admins when PaperCut ran on a domain controller or under a domain administrator service account.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
victims 280 victims
The attacker harvested credentials from 280 victims, obtained operating system or domain secrets from 147, and obtained administrator privileges at 12 organizations.
victims 12 organizations
The attacker harvested credentials from 280 victims, obtained operating system or domain secrets from 147, and obtained administrator privileges at 12 organizations.
organisation LinkedIn
Cybersecurity firm watchTowr, which has been working with PaperCut during the incident, said on LinkedIn that the vulnerabilities allow unauthenticated attackers to bypass authentication and gain remote code execution on affected PaperCut NG/MF instances.
organisation the PaperCut Application
"What we can say: the bulletin advises customers to watch for intrusion-detection, endpoint, or network-monitoring alerts tied to the PaperCut Application Server, and we'll publish indicators of compromise as they're verified." PaperCut servers were previously targeted in 2023 after attackers began exploiting CVE-2023-27350, an authentication bypass and remote code execution vulnerability.
So far, the company has identified several indicators of compromise: Intrusion-detection, endpoint-security, or network-monitoring tools may flag suspicious activity involving the PaperCut Application Server, especially activity linked to pc-app.exe .
If your organization runs one of these older versions, the safest option for now is to remove the PaperCut Application Server from the public internet.
The following indicators of compromise have been shared so far - Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from "pc-app.exe" Missing, unexpectedly truncated, or deleted PaperCut server.log files The presence of the below entries in "server.log" -…
organisation Hackers Are Probing PaperCut Servers
Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch.
infrastructure 2,500 PaperCut installations
Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.
organisation Udydn.out
“After exploitation, the .class file deletes its own  Udydn.out  file, as well as the server’s  server.log  file.
organisation PaperCut NG/MF Application
“If your PaperCut NG/MF Application Server is accessible from the public internet,  immediately  restrict web access to trusted IP addresses only (e.g. internal IP addresses).” states the advisory .
Users who have PaperCut NG/MF Application Server exposed to the internet are advised to immediately restrict access to trusted IP addresses.
organisation IP
Users who have PaperCut NG/MF Application Server exposed to the internet are advised to immediately restrict access to trusted IP addresses.
The company urged customers to remove their servers from the public internet and restrict web access to only trusted IP addresses.
Even though patches are available, PaperCut to urge customers to restrict access to the web interfaces to trusted IP addresses using firewall rules, network access controls, or equivalent measures.
It also recommends disconnecting application servers from the internet and limiting access to trusted IP addresses.
The company says it is aware of confirmed attacks on customers and is urging organizations with Internet-exposed PaperCut Application Servers to immediately restrict access to the web interfaces to trusted IP addresses.
organisation Huntress
Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install.
Multiple cybersecurity companies confirmed evidence of exploitation including Huntress, which said it has at least two customers impacted by the campaign targeting the bugs.
Second emergency patch released On Friday, PaperCut released Emergency Patch Release 2, an updated security fix that includes additional hardening developed after further analysis with its internal security team and researchers at Huntress and watchTowr.
organisation Hutress
reads the report published by Hutress.
organisation Derby
One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn , an oddly named database directory that PaperCut’s own investigation guidance now flags as a high-confidence indicator of compromise.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Philippine nuclear and naval targets)
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Zero-Day)
organisation Patch Released
PaperCut Zero-Day Under Active Attack: Emergency Patch Released PaperCut warns that a zero-day in NG and MF is being exploited.
organisation Xerox
Organizations use PaperCut software to manage a variety of printer brands including Canon, Epson, Xerox, Brother and more.
organisation PaperCut Application Servers
The company says it is aware of confirmed attacks on customers and is urging organizations with Internet-exposed PaperCut Application Servers to immediately restrict access to the web interfaces to trusted IP addresses.
organisation BleepingComputer
BleepingComputer contacted PaperCut with questions about this exploitation and will update the story when we receive a response.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
organisation PaperCut Zero-Day
PaperCut Zero-Day Under Active Attack: Emergency Patch Released.
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions.
organisation SetupCompleted
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of SYSTEM.
organisation University
The company says its security team reproduced the vulnerability using information provided by a University customer.
organisation Application Servers
The company continues to warn customers whose Application Servers are exposed to the Internet to use firewall rules or network access controls to restrict their web interfaces to trusted IP addresses.
Tactical Metrics
Metrics
victims
395
Organizations
AI-powered attack exploited PaperCut flaws to hack 395 organizations.
GreyNoise data indicates that the operation compromised at least 440 PaperCut instances linked to 395 distinct organizations across 48 countries.
Metrics
victims
11
Organizations
“The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds,” GreyNoise notes.
Metrics
victims
280
Victims
The attacker harvested credentials from 280 victims, obtained operating system or domain secrets from 147, and obtained administrator privileges at 12 organizations.
Metrics
victims
12
Organizations
The attacker harvested credentials from 280 victims, obtained operating system or domain secrets from 147, and obtained administrator privileges at 12 organizations.
Metrics
infrastructure
‎Windows
Affected Product
One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver , basic commands to identify the compromised account and Windows version.
The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.
Emergency Patch Release 2 is available for PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS.
Metrics
infrastructure
2,500
Papercut Installations
Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.
Metrics
infrastructure
‎8.8
Software Version
The company released patches for the bugs, tracked as CVE-2026-82078 and CVE-2026-81578,  which both carry severity scores over 8.8 out of 10.
Metrics
infrastructure
‎Linux
Affected Product
Emergency Patch Release 2 is available for PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS.
Metrics
infrastructure
‎Macos
Affected Product
Emergency Patch Release 2 is available for PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS.
Intelligence Sources
The Hacker News 2026-08-28
BleepingComputer 2026-08-27
Security Affairs 2026-08-30
Security Affairs 2026-08-28
BleepingComputer 2026-08-28
TheRecord 2026-08-28
BleepingComputer 2026-09-10
AlienVault OTX 2026-09-09