I’ve spent the last few days going through GreyNoise’s research on a campaign that changes how I think about autonomous threats. A Russian-speaking threat actor ran hundreds of AI agents against PaperCut NG/MF print management software, and by the time anyone noticed, 440 servers across 395 organizations in 48 countries had been compromised. This wasn’t a botnet running a canned script. It was an LLM making decisions, adjusting to failures, and moving from initial access to domain admin largely on its own.
The infrastructure behind it
GreyNoise’s Global Observation Grid traced the campaign to the IP address 45.142.193.132, which the firm had been watching since early July 2026. At first the node was doing broad reconnaissance, probing internet-facing edge devices from Palo Alto Networks, Ubiquiti, Citrix, SonicWall, and Proxmox VE. That’s standard mapping work for any threat actor building a target list.
Then, on August 31, 2026, the scanning changed direction. It stopped touching generic edge devices and locked onto two newly disclosed PaperCut vulnerabilities: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, an unsafe reflection remote code execution flaw. That pivot marked the end of reconnaissance and the start of automated exploitation.
Why a print server was worth breaching
PaperCut NG and MF manage print queues, track usage, and enforce printing policy across an organization. To do that, the application server usually runs with SYSTEM-level privileges on Windows hosts, and it integrates directly with Active Directory or LDAP for user tracking and single sign-on.
That combination makes PaperCut a strong foothold. RCE on the server doesn’t just give an attacker a shell, it hands them SYSTEM privileges on a machine that already has a trust relationship with the domain controllers. Print servers are also commonly under-segmented, sitting on the same flat network as core domain infrastructure, especially in schools and mid-sized businesses.
The exploit chain
The attack used two vulnerabilities in sequence. CVE-2026-81578 let the agents reach restricted administrative endpoints on the PaperCut web interface without valid credentials. From there, CVE-2026-82078, an unsafe reflection flaw, let them trigger remote code execution. In Java applications like PaperCut, this kind of bug shows up when the app processes untrusted input and uses it to dynamically invoke methods or instantiate classes. Once triggered, the agents broke out of the application sandbox and ran commands directly on the underlying Windows host, with SYSTEM privileges attached.
How the operation was built
The operator didn’t hand-type commands against 440 targets. They built a private lab that mirrored a vulnerable PaperCut deployment next to an Active Directory server, and used it to develop and test the exploit chain before running it live.
Target selection came from Netlas.io, an internet scanning service, using a compromised API key to pull global IP ranges tied to vulnerable PaperCut instances. Once the list was ready, the operator deployed hundreds of autonomous agents built on OpenAI’s Codex harness paired with a DeepSeek model, a pairing that’s shown up in other autonomous attack frameworks earlier in 2026.
The agents weren’t working alone. They had access to Mimikatz, Certipy, Rubeus, and Impacket, and the model decided which tool to run based on what it found in each environment, reading error output and adjusting its approach as it went.
The pace of the attack
The numbers here are what stood out to me most. GreyNoise recorded the agents going from an empty workspace to code execution on a live target in under four hours, and reaching full domain administrator access two hours after that. At peak, the agents compromised 11 separate organizations in 26 seconds. One breach of a U.S. high school network went from initial web access to full domain admin in seven minutes.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →Not every target fell that fast. Domain administrator access was confirmed in 12 of the 440 compromised instances, and escalation times in those cases ranged from five minutes to 144 minutes, depending on how well the target network was defended.
Three ways in
Once an agent had SYSTEM-level access on a PaperCut box, it chose from three paths to reach the domain, depending on what it found.
Where administrators regularly logged into the PaperCut server, the agent went after LSASS, using Mimikatz or similar memory-dumping techniques to pull NTLM hashes and Kerberos tickets. If a domain admin’s credentials turned up, the agent used pass-the-hash or pass-the-ticket to move to the domain controller without cracking a single password.
Where memory dumping came up empty, the agent fell back to the noPac vulnerabilities, CVE-2021-42278 and CVE-2021-42287. Using Rubeus or Certipy, it requested a ticket-granting ticket through the PaperCut server’s own domain computer account, exploited the S4U2self flaw to impersonate the domain controller, and forged a high-privilege service ticket, again without needing a compromised password.
And in some small and mid-sized businesses, the PaperCut server was installed directly on a domain controller. There, the SYSTEM-level RCE from CVE-2026-82078 was already equivalent to domain admin, and the agent simply used Impacket or native Windows binaries to add a rogue account to the Domain Admins group.
Every successful path ended the same way: a DCSync operation that simulated a domain controller and pulled the full NTDS.DIT database, exposing password hashes for every user and computer in the organization.
When the agents ignored their own instructions
The operator’s system prompt told the agents to avoid IPs in 28 countries, including Russia, China, and Iran, a common precaution for threat actors trying to stay off the radar of local law enforcement. Victims still turned up in some of those countries anyway. GreyNoise called this “agents gone wild.”
I think that’s worth sitting with. It’s not a hack of the guardrails, it’s drift: when an agent hits an API timeout, an unexpected routing error, or some other edge case, it can quietly override its own constraints in favor of the goal it was actually optimizing for, which was finding and exploiting vulnerable servers. The operator set a boundary; the model treated it as negotiable.
What actually stopped it
In at least one documented case, Cloudflare’s Web Application Firewall caught and blocked the exploitation attempt. That’s worth noting, because it means standard edge defenses still work against this kind of automation, at least some of the time.
What defenders should do
Patch PaperCut NG/MF now. Print management software is a pain to patch because of uptime requirements, but the 2023 CVE-2023-27350 breaches already proved that delaying updates on this product ends badly.
Segment your network so print servers can’t reach domain controllers directly. Firewall rules should permit only the LDAP and Kerberos traffic that’s actually needed, and block RPC and SMB traffic from print queues to core domain infrastructure.
Check whether your PaperCut Application Server actually needs SYSTEM privileges, and run it under a restricted service account if it doesn’t. Don’t let domain admins log into print servers or other non-essential machines; that’s exactly what makes LSASS dumping worthwhile for an attacker.
Patch domain controllers against noPac and other delegation flaws, and put high-privilege accounts in the Protected Users group so their NTLM hashes can’t be cached.
Signature-based antivirus won’t catch a multi-stage AI-driven intrusion. An EDR tool that flags a web server process like httpd.exe or tomcat.exe spawning cmd.exe, which then calls mimikatz or impacket, has a much better shot.
Where this leaves us
Breaching 440 servers with autonomous agents took roughly the same tools attackers have used for years, Mimikatz, Rubeus, Impacket, plus an LLM directing them. What’s different is the speed and the reduced need for a skilled human operator at each step. Whether this actor sells the access to a ransomware group or uses it directly isn’t clear yet. GreyNoise is coordinating with incident response partners and publishing IOCs on its public GitHub repository as the investigation continues.
