Exposed Attacker Server Reveals AI Agent Toolkit and a Second PaperCut RCE Path
Do Son 
| At a glance | |
| Malware family | Custom PaperCut exploit kit, Rust credential collectors, chisel-based reverse SOCKS5 tunnels |
| Threat actor | Unnamed; suspected Russian-speaking operator using AI coding agents |
| Targets | Internet-facing PaperCut NG/MF servers, many in education; 440+ instances compromised per GreyNoise and Blackpoint Cyber |
| Delivery vector | CVE-2026-81578 and CVE-2026-82078, plus a weakly protected XML-RPC API |
| Key capabilities | Remote code execution, credential theft, internal pivoting, Metasploit automation |
| Source | Hunt.io research, with figures from GreyNoise and Blackpoint Cyber |
TL;DR
Hunt.io found three open directories on one attacker server running the PaperCut RCE campaign. The files held AI agent instructions, exploit code, and victim data from hundreds of targets. They also exposed a second PaperCut RCE route through the XML-RPC API that works even after the main bug is blocked.
Background
On August 27, 2026, PaperCut disclosed two actively exploited flaws in its NG/MF print software. CVE-2026-81578 lets an unauthenticated request reach an admin-only component. CVE-2026-82078 is an unsafe reflection bug in database driver loading. Rapid7 and Huntress soon documented the attack chain.
Later, GreyNoise linked the campaign to a likely Russian-speaking actor running hundreds of AI agents. GreyNoise and Blackpoint Cyber counted at least 440 compromised PaperCut instances at 395 organizations in 48 countries.
Delivery
The operator’s own files show how it picked targets. First, a read-only probe checked each server without changing settings. A vulnerable server returned an error page, while a patched one redirected to the home page. In one batch of 40 African targets, the tool flagged 15 as vulnerable.
Overall, the actor’s notes list a reconnaissance pool of 1,005 hosts across at least 45 countries. The US and UK led the list.
Infection chain
Hijacking the user lookup
Once a target checked out, the script rewrote PaperCut’s external user lookup settings. This pointed a card lookup at attacker-supplied database code. Depending on the PaperCut version, the exploit ran code through the H2 or Apache Derby database engines. Finally, each script reset the settings, so the configuration looked untouched afterward.
A second PaperCut RCE path
The actor’s research notes describe another way in. PaperCut ships with an XML-RPC API. If no API token is set and the network allowlist is loose, the API accepts the built-in admin password instead. As a result, an attacker can change settings without touching the original bug.
In the actor’s own words, this is “a second local RCE chain proven when API network and token controls are weak.” Hunt warns that a server hardened against the main flaw “is not necessarily protected” if this API is exposed with weak access controls.
An AI agent running the show
The core of this AI-assisted exploitation was a 19 KB file called AGENTS.md. It served as the AI agent’s operating instructions. It mixes Russian and English and names Codex paired with a DeepSeek model. The file tells the agent to assume the bug exists and switch tactics after two failures. It also allows up to 25 subagents at once, which explains GreyNoise’s “hundreds of AI agents.”
A section called “underground mode” frames the work as an authorized training exercise. Hunt calls this “a common jailbreak technique for bypassing model safety restrictions.” Meanwhile, the agent wrote status files about every ten minutes, leaving a near-complete campaign diary.
Command-and-control and data exfiltration
After access, a four-stage pipeline took over. First, custom Rust tools pulled Windows registry hives and LSA secrets to recover machine account hashes. Another script hunted for LDAP and database passwords in config files. Next, a Java bridge turned each PaperCut server into a SOCKS5 pivot into the internal network.
Metasploit automation then ran across the full target list. The logs show 2,165 attempts, 13 successes, and five interactive sessions. Finally, the operator packaged each victim into a kit with credentials and proxy settings for later reuse.
On Linux, a chisel client kept a reverse SOCKS5 tunnel alive through cron jobs and a watchdog script. At capture time, 45 targets had a live tunnel. The kits also named 46 Active Directory domains, and 18 of them pointed to schools and universities.
Attribution
Attribution remains suspected. Both GreyNoise’s analysis and the Russian-language instructions point to a Russian-speaking operator. However, no named group has been tied to the campaign.
Defense and detection guidance
Hunt stresses that behavior travels further than any single IP address. Key steps include:
- Upgrade PaperCut NG/MF to 26.0.5, 25.0.13, 24.1.10, or later.
- Treat any server exposed around late August as possibly compromised, even after patching.
- Disable the XML-RPC API if unused. Otherwise, require an explicit API token and a tight allowlist.
- Look for unexpected user-lookup setting changes, new .class files, and odd files in the custom web folder.
- Hunt Linux hosts for hidden folders under /var/tmp, chisel processes, and suspicious @reboot cron entries.
- Rotate every credential the PaperCut service account could reach.
- Block unrestricted outbound traffic from PaperCut servers.
In short, this PaperCut RCE campaign shows how AI agents can scale a print-server bug into hundreds of network breaches.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
