Executive Summary

Key Figures

Source: GreyNoise, AI-Orchestrated Campaign Against PaperCut NG/MF

PaperCut NG/MF is an ordinary piece of back-office software that schools and companies use to track printing. It is a self-hosted Java web application, it runs with SYSTEM privileges by default on Windows, and it is usually domain-joined and wired into Active Directory. That last property matters later. On 27 August PaperCut issued a security advisory covering CVE-2026-81578, which lets configuration be changed without authenticating, and CVE-2026-82078, which turns a database connector into code execution. Chain the two together and a single unauthenticated web request becomes arbitrary code inside the PaperCut service. The campaign began four days later, on 31 August.

GreyNoise records the opening of that day like this.

“On 31 August 2026, a likely Russian-speaking malicious cyber actor (MCA) used 45.142.193.132 and artificial intelligence (AI) to develop, test, and use exploits for PaperCut NG/MF.”

GreyNoise logged the rest of that day minute by minute. At 14:44 UTC the attacker created an empty workspace and pulled down the advisory along with both the pre-patch and post-patch builds. At 15:54 the components of the two installations came out for side-by-side comparison, which is how the exploit fell out of the fix. The result went first against a patched and an unpatched server in Africa. At 16:09 a purpose-built multi-threaded tool narrowed the field to 462 candidates, and at 16:26 a country database arrived so that 1,005 candidates could be sorted by where they sat. At 16:35 a private lab went up with an Active Directory server and a vulnerable PaperCut install, and at 17:02 eight fake users were added to that lab's directory. At 18:39:39 the first remote code execution and shell landed on a victim in Australia, 3 hours and 55 minutes after the workspace was created. Domain admin on that same victim was confirmed at 21:00.

The 26 seconds belong to the next day. At 08:30 on 1 September the agents opened hundreds of SSH sessions to a second host and the campaign proper began. Eleven organizations went down in its first 26 seconds, and credential harvesting started before the first minute was out. Within the first hour 78 organizations were compromised, 8 of them all the way to domain admin. By 23:12, the last remote code execution of that day, the running total had passed 223 instances, with the remainder mopped up the following day. So the widely quoted 26 seconds is the reading at the instant the door opened, well before the campaign hit full stride. The fastest single case was a U.S. high school, where initial access to domain admin took 7 minutes. Across all victims, times to domain admin scattered between 5 and 144 minutes.

The slow cases are not evidence that a defense held. Several victims saw days pass between initial access and domain admin, and GreyNoise attributes that delay to the attacker simply not following up right away. The side that waited was the offense.

The incident is traveling as the sentence “AI autonomously breached 440 servers.” Blackpoint, which looked deepest into the attacker's infrastructure, cut that reading off in its own report before anyone else could make it.

“The campaign is not evidence of fully autonomous exploitation. Nothing recovered shows an AI model independently discovering a zero day, choosing hundreds of targets, and compromising them without human involvement.”

So what did the AI actually do? The same report answers a paragraph later.

“The strongest AI impact in this campaign was not a novel exploit technique. It was the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems.”

No new technique appeared. The agents took over the repetitive labor a human used to absorb, and the recovered artifacts show how thick that repetition was. Target selection alone worked as a funnel, not a single sweep. Lists from several sources were merged into an inventory of more than 15,000 address and port combinations, filtered by country, then run through cheap reachability checks on pools of 32 and 80 workers so that only live PaperCut instances reached the expensive remote code execution stage. The widest list held 4,107 unique IPs, but it was only one input, and Blackpoint notes that the recovered files do not preserve how that list was produced. Systems already finished dropped out of the next list. The first runner checkpoint on 1 September carried 517 targets, and the retry wrapper was set to 200 threads across up to 100 rounds.

The failure summary dated 1 September does not leave its 291 failed targets in one bucket. It splits them by cause. In 161 cases the exploit chain reached its trigger but the expected output file was never served; in 60 the code ran but administrator account creation was blocked; in 56 the configuration change was refused; 12 timed out. The 60 split again into 19 where Windows denied access, 17 or more that never reached a domain context, and 7 that were not Windows at all and had no net command. Access denied, no domain, and Linux each call for a different follow-up. Splitting failures that way lets the next round target the actual problem.

The pipeline kept going back over its own mistakes. Scaling up made every container grab the same fetch port, which broke the payloads, and the runner was changed to hand each target its own port. Systems that kept failing turned out to be listening only on HTTPS, and once the shared code learned to cover both protocols eight more machines were finished off. Even the success check was wrong for a while: it had been counting success strings inside command text generated before any session actually opened, and it was rewritten to demand proof that a real session existed. At one point a fix to Windows local administrator rights quietly vanished from an alternate path added later, and a follow-up audit caught the regression and restored it to the shared runner. Features were not merely piled on; earlier fixes were checked for survival. GreyNoise's timeline carries a matching line at 17:15 on 1 September, where the operation recognizes a bug, fixes it automatically, and carries on.

The places where a human was present also left marks. The GreyNoise timeline flags points where human confirmation or policy intervened: at 16:04 on 31 August the operator is asked for permission to continue, at 19:14 the same day the excluded-country list is applied, and at 17:01 on 1 September the campaign runs into a Cloudflare firewall and the U.S. thread count is adjusted. State files recovered by Blackpoint carry the same texture, with sentences about assembling a dump the user requested and about a long scan the user interrupted. Human involvement did not vanish. It became infrequent.

The household equipment for running agents turned up too: Hindsight, a persistent memory service that carries an agent's state across broken sessions, and AionUi, a graphical workspace for driving several agents from one screen. Neither was built for offense. Both are the kind of thing anyone who wants agents to run for a long time ends up bolting on. With that ordinary tooling bolted on, one person's instruction multiplies into several hundred executions. That is the threshold this campaign crossed, and it is a good deal less dramatic than a new weapon.

We have seen a similar structure before, in the GTG-1002 campaign Anthropic disclosed in November 2025. That group, assessed with high confidence as Chinese state-sponsored, used Claude Code as an autonomous penetration-testing orchestrator. It got around the safeguards by slicing the attack into small pieces and claiming to be an employee of a legitimate security firm running defensive tests. By Anthropic's count AI performed 80 to 90 percent of the tactical work, with humans stepping in at only 4 to 6 decision points per campaign. The targets were roughly 30 technology, financial, chemical, and government organizations.

The two incidents differ in purpose and in scale. The overlap is structural.

Twice in ten months is not an anomaly. In between, the threshold dropped. GTG-1002 was a selective operation backed by state-level resources. This one was bulk work assembled from a publicly available coding agent harness and a cheap model.

There is also little reason to treat this attacker as exceptional. GreyNoise had been tracking the address used in this campaign since early July, because the same address kept showing up against internet-exposed gear from Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox. An ordinary vulnerability hunter swapped tools, and two months later the same hands produced an operation spanning 48 countries. The earlier incident showed the capability existed. This one shows how cheaply it reproduces.

Start with how one print management server becomes an entire domain. The property noted earlier pays off here. PaperCut runs with SYSTEM privileges by default on Windows and is usually domain-joined and attached to Active Directory. GreyNoise documents three paths to domain admin. Where the compromised PaperCut host was a domain member, the attacker scraped LSASS process memory and registry secrets to recover privileged credentials, then passed the hash to the domain controller. Where CVE-2021-42278 and CVE-2021-42287, both public since 2021, were still unpatched, the attacker used the noPac attack. And where PaperCut sat on top of a domain controller or ran under a domain admin service account, the freshly created account simply went into the Domain Admins group. That third path needs no exploit at all. One setting nobody ever revisited was enough. All three paths ended the same way, with DCSync lifting the entire directory database and every credential in the organization.

The vulnerabilities were only the means of opening the door, and once inside the agents converged on close to a single activity. Of the 440 compromised instances, 280 gave up credentials and 147 also surrendered operating system and domain secrets. Twelve organizations were carried all the way to domain admin. The attacker kept roughly two dozen public offensive tools on hand, and while not all of them were used here, the list itself clusters around credential theft and privilege escalation.

The campaign was already visible from outside four days before either report landed. Arctic Wolf said that as of 5 September it had observed the same two vulnerabilities being exploited against education institutions in the United States and Europe, spanning everything from elementary schools to large universities. Among the commands observed then was a findstr sweep through PaperCut configuration files for the words password, secret, ldap, bind, and token. That single line says everything about what the attacker wanted from those servers.

The damage skewed heavily toward education. Of the 440 compromised instances, 204 belonged to education institutions, followed by retail, professional services, and hospitality. By country, the United States led with 98, then the United Kingdom with 59, France and Spain with 31 each, and Canada with 24. GreyNoise warns that the concentration should not be read as target selection. The campaign was opportunistic, and the abundance of education victims is more likely attributable to PaperCut's customer base. They were not picked out. They were there.

That 440 instances fell while only 12 were fully taken over also means defenses did work across the rest of that distance. GreyNoise says as much: organizations are not helpless against agentic attacks, traditional hardening does improve an organization's security posture, and in at least one case Cloudflare's Web Application Firewall defeated the adversary. That defensive line is still made of accounts and privileges. Whether the attacker came in through an authentication bypass or through noPac, the thing picked up at the far end was credentials.

This campaign could be reconstructed in such detail because the attacker left an HTTP directory on their own infrastructure open to the internet. Blackpoint reached that address while containing a single compromised PaperCut server, and pulled down an entire working directory of development files, target lists, campaign output, state files, and several generations of exploit code. The investigation started at the attacker's workbench.

One of the files there is drop-countries.txt, a list of 28 countries to exclude from targeting, among them Russia, China, Iran, Ukraine, Brazil, Türkiye, and Nigeria. Its contents shifted while the campaign ran. Cambodia and Sri Lanka came off the exclusion list, and later an instruction was added to drop Brazil, South Africa, Nigeria, and Zimbabwe from a new stage's list. Operational instructions a human kept giving the agents accumulated in that file. Even so, in some cases the exclusions were not honored. The gap between instruction and execution is in the files too.

GreyNoise declined to write that gap off as attacker error, which is part of why its report is titled “Agents Gone Wild.” One of its three key takeaways holds that unless properly constrained, agentic operations can deviate from expected behavior and pose operational risk. Why these agents deviated is still uncertain, GreyNoise adds. Quite apart from the fact that the party giving instructions here was a criminal, that sentence applies to everyone running agents. The attacker did not fully know what their own agents would do either.

Even the handoff documents that bridge one session to the next were sitting in that directory. Blackpoint describes the recovered state files this way.

“Timestamped state files read like persistent coding agent context. They record completed work, blockers, next hypotheses, user interruptions, code changes, current campaign status, and the exact artifacts needed for a later session to continue.”

Finished work, blockers, next hypotheses, user interruptions, code changes, current status, and the artifacts the next session would inherit, all stamped with a time. Anyone who has kept a coding agent running for a while knows the format. The attacker wrote those files so that their own agents could pick up the next session, and that convenience ended up handing investigators the best material they had.

One firm read the incident through identity management. Silverfort sells identity security products, which is worth keeping in mind, but the point it raised does not conflict with the numbers in this campaign. Fast alone is survivable in one place, and wide alone is survivable slowly; put the two together and the one organization that notices has no time to warn the other 394. A second assumption security operations has leaned on wobbles alongside it, namely that an attacker's attention is finite and will reach a valuable asset before it reaches a rural school's print server. When compute is the only constraint, nothing is too small to bother with.

From here we leave the two reports behind and hold the same yardstick up to how we run agents ourselves. The agents we attach inside a company leave that kind of trace too. Which key touched what, where the run stalled, which instruction arrived and what the agent meant to do next, all of it accumulates in files and logs. This incident showed by accident that such a record is investigable data. Three questions follow.

• How far can a credential an agent holds travel in a few seconds? Once credentials leak, the floor on time-to-full-compromise in this incident was 7 minutes. Compare that against how long it takes a group of people to agree on a judgment.
• How long are the unattended stretches? Autonomy is not the variable. The distance between one checkpoint and the next is what sets the size of the risk.
• Does the agent's record of its own behavior survive in a form someone can read afterwards? The attacker's files were legible to that degree, which means our own records can be read at the same resolution if we design them for it.

The two reports narrowed the scope of their own conclusions. This is the record of one attacker, one product, one campaign. The end goal remains unconfirmed. Nevan Beal, principal MDR analyst at Blackpoint, said that at this time the exact end goal of the campaign cannot be confirmed, and that while the methodology is consistent with initial-access activity, there is not yet sufficient evidence to say so. That compromised instances and organizations are different units, and that the 26 seconds records the moment after launch rather than the pace of the whole campaign, belong in every retelling as well.

Thank you for reading this far. The original reports are available from GreyNoise and Blackpoint. If you are willing, we would like to hear where you have drawn the line on what your agents are allowed to reach, and what you use to confirm that boundary.

Primary Sources

• 1.GreyNoise. (Sep. 9, 2026). "AI-Orchestrated Campaign Against PaperCut NG/MF." GreyNoise Blog.
• 2.Blackpoint Cyber. (Sep. 9, 2026). "Death by a Thousand PaperCuts: AI-Driven Exploitation at Scale." Blackpoint Cyber Blog.

News & Industry Coverage

• 3.The Hacker News. (Sep. 10, 2026). "PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances."
• 4.Help Net Security. (Sep. 11, 2026). "AI agents exploited PaperCut flaws to breach 395 organizations."
• 5.Silverfort. "PaperCut Breach: What AI Agent Attacks Teach Us About Identity Security Resilience." Silverfort Blog.

Comparative Reference

• 6.Anthropic. (Nov. 14, 2025). "Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign." (GTG-1002 report)