HUNT [.]io researchers uncovered three open directories on an attacker server involved in a PaperCut RCE campaign, exposing AI-assisted exploitation toolkit elements and victim data from hundreds of targets. The exposed material includes AI agent instructions, exploit code, and scripts used to pivot within compromised networks, as well as a second PaperCut RCE route that persists even after the primary vulnerability is mitigated.
PaperCut NG/MF targets were driven by CVEs identified in August 2026: CVE-2026-81578, which allows unauthenticated access to an admin-only component, and CVE-2026-82078, an unsafe reflection bug in database driver loading. The article notes that a weak XML-RPC API access path can yield a further local RCE when API tokens are absent or allowlists are lax, enabling attackers to alter settings without exploiting the original bug.
GreyNoise and Blackpoint Cyber counted at least 440 compromised PaperCut instances across 395 organisations in 48 countries, with the US and UK highlighted in the attacker’s reconnaissance notes.
Operational details describe a multi-stage infection and data-exfiltration pipeline. After initial access, the campaign hijacked PaperCut’s external user lookup, steering it toward attacker-supplied code via the H2 or Apache Derby engines, then restoring settings to appear unchanged. A second RCE path relies on the XML-RPC API with weak controls.
The core of the operation appears to be an AI-assisted framework, centred on a 19 KB AGENTS[.]md file that instructed up to 25 subagents and recorded near-continual status updates. Post-access activity included extracting Windows registry hives, LSA secrets, and credentials, pivoting via a Java bridge to internal networks, and using a chisel-based reverse SOCKS5 tunnel for persistence.
Defence guidance emphasizes patching to PaperCut NG/MF 26.0.5, 25.0.13, 24.1.10 or later, tightening API access, and monitoring for unexpected user-lookup changes and covert credential access.