Skip to content
OriginalSign in

Dark ReadingRobert Lemos

AI Swarm Breached 440 PaperCut Servers Before Reaching Domain Admins

Part of the PaperCut story · since 28 Aug

Quiet for 6 weekslast report 11 Sep21 articles6 outlets
28 Aug · The Hacker News first8 Oct18 OctNowThis article21st of 21
  • Fri 28 Aug, 18:17 UTC. The Hacker News, first report. Attackers exploit PaperCut print flaws to run code without auth.
  • Sun 30 Aug, 12:31 UTC. Security Affairs, its first report on the story. Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 07:01 UTC. SecurityWeek, its first report on the story. PaperCut rolls out second patch following zero day RCE attacks. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 11:29 UTC. SecurityOnline, its first report on the story. Critical PaperCut zero day lets hackers bypass auth and run code. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 16:22 UTC. CISA, its first report on the story. CISA warns of critical PaperCut NG/MF flaw CVE-2026-82078. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 16:32 UTC. CISA. CISA adds two critical PaperCut flaws to KEV after exploits. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 16:36 UTC. CISA. CISA warns of exploited PaperCut NG/MF flaw CVE-2026-81578. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 01:02 UTC. CISA. CISA KEV Flags PaperCut NG/MF Flaw Allowing Remote Config Changes. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 02:41 UTC. SecurityOnline. PaperCut NG/MF Under Attack as OpenAI Hits $1B Ad Revenue. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 04:21 UTC. SecurityOnline. PaperCut NG/MF exploits found as Codex updates context handling. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 05:30 UTC. SecurityWeek. PaperCut Zero Day Flaw CVE-2026-82078 Exploited, CISA Issues Alert. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 08:56 UTC. Security Affairs. CISA flags PaperCut CVE-2026-81578 flaw amid active exploits. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 13:14 UTC. CISA. CISA warns of critical PaperCut NG/MF flaw CVE-2026-82078. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 07:43 UTC. The Hacker News. Hackers Exploit PaperCut Flaws to Steal Credentials in Schools. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 19:49 UTC. Security Affairs. Attackers Exploit PaperCut Flaws to Breach School Networks. Cites a CVE in CISA KEV.
  • Sun 6 Sep, 08:50 UTC. Security Affairs. Security Affairs Roundup Tracks PaperCut Attacks and Chrome Exploits.
  • Mon 7 Sep, 04:31 UTC. SecurityOnline. CISA KEV Missed Four Actively Exploited AI and WordPress Flaws. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 13:26 UTC. The Hacker News. AI-Driven Campaign Exploits PaperCut Flaws Across 440 Instances. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:48 UTC. The Hacker News. PaperCut Fixes Actively Exploited Flaws After 395 Organisations Hit. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 08:23 UTC. SecurityWeek. AI-Powered Attacks Exploit PaperCut Flaws at 395 Organisations. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. Dark Reading, its first report on the story. AI Swarm Breached 440 PaperCut Servers Before Reaching Domain Admins. This article, 21st of 21.

In late August, GreyNoise reported that a likely Russian-speaking actor deployed hundreds of AI agents, trained in a lab, to locate Internet-connected Papercut print management servers, compromise the software and opportunistically move to Windows Active Directory environments. The campaign targeted Papercut NG and MF installations, affecting at least 440 instances across 395 organisations in 48 countries.

The analysis highlights the speed at which the AI swarm operated: from an initial foothold to remote code execution against a victim in just under four hours, reaching Active Directory domain admin within two more hours, and, once the campaign was underway, compromising multiple organisations in seconds.

Researchers emphasised that large language models are enabling attackers to scale and accelerate operations, while Google noted the growing availability of open-weight models is broadening access to agentic capabilities. The report also discusses the broader trend of AI-assisted attack lifecycles, including attempts to curb victimology in some cases and the risks of LLM hijacking and cloud-infrastructure abuse.

Defence rests on established security hygiene: multi-factor authentication, restrictive permissions and token lifetimes to hinder lateral movement, and monitoring for abnormal behaviour. Experts urge defenders to automate detection and response while retaining human oversight to maintain context and judgement.

How the story developed

All 21 articles
Quiet for 6 weekslast report 11 Sep21 articles6 outlets

21 articles from 6 outlets since 28 Aug. Quiet since 11 Sep. This was the 21st report, 14 days after the first.

Now28 Aug3123456789101112First reportThe Hacker News · 28 Aug, 18:17This article21st of 21 · day 14
  • Fri 28 Aug, 18:17 UTC. The Hacker News, first report. Attackers exploit PaperCut print flaws to run code without auth.
  • Sun 30 Aug, 12:31 UTC. Security Affairs, its first report on the story. Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 07:01 UTC. SecurityWeek, its first report on the story. PaperCut rolls out second patch following zero day RCE attacks. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 11:29 UTC. SecurityOnline, its first report on the story. Critical PaperCut zero day lets hackers bypass auth and run code. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 16:22 UTC. CISA, its first report on the story. CISA warns of critical PaperCut NG/MF flaw CVE-2026-82078. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 16:32 UTC. CISA. CISA adds two critical PaperCut flaws to KEV after exploits. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 16:36 UTC. CISA. CISA warns of exploited PaperCut NG/MF flaw CVE-2026-81578. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 01:02 UTC. CISA. CISA KEV Flags PaperCut NG/MF Flaw Allowing Remote Config Changes. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 02:41 UTC. SecurityOnline. PaperCut NG/MF Under Attack as OpenAI Hits $1B Ad Revenue. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 04:21 UTC. SecurityOnline. PaperCut NG/MF exploits found as Codex updates context handling. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 05:30 UTC. SecurityWeek. PaperCut Zero Day Flaw CVE-2026-82078 Exploited, CISA Issues Alert. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 08:56 UTC. Security Affairs. CISA flags PaperCut CVE-2026-81578 flaw amid active exploits. Cites a CVE in CISA KEV.
  • Tue 1 Sep, 13:14 UTC. CISA. CISA warns of critical PaperCut NG/MF flaw CVE-2026-82078. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 07:43 UTC. The Hacker News. Hackers Exploit PaperCut Flaws to Steal Credentials in Schools. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 19:49 UTC. Security Affairs. Attackers Exploit PaperCut Flaws to Breach School Networks. Cites a CVE in CISA KEV.
  • Sun 6 Sep, 08:50 UTC. Security Affairs. Security Affairs Roundup Tracks PaperCut Attacks and Chrome Exploits.
  • Mon 7 Sep, 04:31 UTC. SecurityOnline. CISA KEV Missed Four Actively Exploited AI and WordPress Flaws. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 13:26 UTC. The Hacker News. AI-Driven Campaign Exploits PaperCut Flaws Across 440 Instances. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:48 UTC. The Hacker News. PaperCut Fixes Actively Exploited Flaws After 395 Organisations Hit. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 08:23 UTC. SecurityWeek. AI-Powered Attacks Exploit PaperCut Flaws at 395 Organisations. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. Dark Reading, its first report on the story. AI Swarm Breached 440 PaperCut Servers Before Reaching Domain Admins. This article, 21st of 21.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 21 articles as a list
  1. Fri 28 AugDay 01
    1. Attackers exploit PaperCut print flaws to run code without auth18:17 · The Hacker News · First report

  2. Quiet for 2 days

    Sun 30 AugDay 21
    1. Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch12:31 · Security Affairs · Exploited CVE · Known exploited CVE
  3. Mon 31 AugDay 35
    1. PaperCut rolls out second patch following zero day RCE attacks07:01 · SecurityWeek · Known exploited CVE
    2. Critical PaperCut zero day lets hackers bypass auth and run code11:29 · SecurityOnline · Known exploited CVE
    3. CISA warns of critical PaperCut NG/MF flaw CVE-2026-8207816:22 · CISA · official · CISA alert · Known exploited CVE
    Show 2 more from 31 Aug
    1. CISA adds two critical PaperCut flaws to KEV after exploits16:32 · CISA · official · Known exploited CVE
    2. CISA warns of exploited PaperCut NG/MF flaw CVE-2026-8157816:36 · CISA · official · Known exploited CVE
  4. Tue 1 SepDay 46
    1. CISA KEV Flags PaperCut NG/MF Flaw Allowing Remote Config Changes01:02 · CISA · official · Known exploited CVE
    2. PaperCut NG/MF Under Attack as OpenAI Hits $1B Ad Revenue02:41 · SecurityOnline · Known exploited CVE
    3. PaperCut NG/MF exploits found as Codex updates context handling04:21 · SecurityOnline · Known exploited CVE
    Show 3 more from 1 Sep
    1. PaperCut Zero Day Flaw CVE-2026-82078 Exploited, CISA Issues Alert05:30 · SecurityWeek · Known exploited CVE
    2. CISA flags PaperCut CVE-2026-81578 flaw amid active exploits08:56 · Security Affairs · Known exploited CVE
    3. CISA warns of critical PaperCut NG/MF flaw CVE-2026-8207813:14 · CISA · official · Known exploited CVE

  5. Quiet for 4 days

    Sat 5 SepDay 82
    1. Hackers Exploit PaperCut Flaws to Steal Credentials in Schools07:43 · The Hacker News · Picked up again · Known exploited CVE
    2. Attackers Exploit PaperCut Flaws to Breach School Networks19:49 · Security Affairs · Known exploited CVE
  6. Sun 6 SepDay 91
    1. Security Affairs Roundup Tracks PaperCut Attacks and Chrome Exploits08:50 · Security Affairs
  7. Mon 7 SepDay 101
    1. CISA KEV Missed Four Actively Exploited AI and WordPress Flaws04:31 · SecurityOnline · Known exploited CVE

  8. Quiet for 3 days

    Thu 10 SepDay 131
    1. AI-Driven Campaign Exploits PaperCut Flaws Across 440 Instances13:26 · The Hacker News · Picked up again · Known exploited CVE
  9. Fri 11 SepDay 143
    1. PaperCut Fixes Actively Exploited Flaws After 395 Organisations Hit07:48 · The Hacker News · Known exploited CVE
    2. AI-Powered Attacks Exploit PaperCut Flaws at 395 Organisations08:23 · SecurityWeek · Known exploited CVE
    3. AI Swarm Breached 440 PaperCut Servers Before Reaching Domain Admins16:30 · Dark Reading · This article, 21st of 21

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in