AI Agents Weaponized in PaperCut Cyberattack Hitting 440+ Targets Across 48 Countries

A suspected Russian-speaking threat actor deployed hundreds of artificial intelligence agents to exploit critical vulnerabilities in PaperCut print management software, compromising more than 440 instances across 395 organizations in 48 countries. Uncovered by threat intelligence firms Blackpoint Cyber and GreyNoise and reported on September 10, 2026, researchers are calling this a landmark moment in AI-assisted cyberattacks. The attacker moved from an empty workspace to compromising a real victim in under four hours and breached at least 11 organizations in just 26 seconds once the campaign launched in earnest.

---

How the AI-Powered Attack Unfolded

The Vulnerabilities Exploited

At the center of the attack are two newly disclosed vulnerabilities: CVE-2026-81578 and CVE-2026-82078. The combination of an authentication bypass and a remote code execution flaw gave the attacker a powerful entry point into PaperCut NG/MF instances, primarily targeting the education sector across the U.S., U.K., France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland.

The malicious activity originates from the IP address 45.142.193[.]132, which GreyNoise has tracked since early July 2026 for probing internet-facing systems from vendors including Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE. Arctic Wolf had already flagged the same address in connection with exploitation activity the prior week.

From Lab Environment to Live Targets

Once the threat actor validated the exploit chain inside a self-hosted lab environment — one that included vulnerable PaperCut software and an Active Directory server — they deployed hundreds of AI agents powered by OpenAI Codex and a DeepSeek model. These agents worked alongside well-known offensive security tools including Mimikatz, SharpHound, Certipy, Rubeus, and Impacket to automate the attack at scale.

The attacker also used the internet scanning service Netlas.io with an identified API key to build target lists. Post-exploitation activity included the delivery of Windows registry hive collection tools, Metasploit and Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitive configuration data.

In one particularly alarming case involving a U.S. high school, the time between initial access and full domain administrator access was a mere seven minutes. In total, the adversary gained domain administrator access against 12 victim organizations. The speed and precision of these intrusions reflects a new operational tempo that traditional security monitoring was not designed to detect.

Understanding the evolving relationship between AI and offensive security is increasingly important for defenders — exploring how AI is reshaping the cybersecurity threat landscape provides critical context for what this campaign represents.

---

The AI Engine Behind the Operation

An Automated Workflow From Research to Exploitation

What makes this campaign extraordinary is not the sophistication of any single exploit but the way AI transformed the entire operational pipeline. Blackpoint traced the activity back to exposed operator infrastructure that revealed an AI-assisted workflow spanning vulnerability research, exploit development, target filtering, failure analysis, code revision, and repeated retry waves.

"The earliest recovered activity began on August 31, with the project focused on vulnerability research and comparing patched and unpatched PaperCut builds," wrote Blackpoint principal MDR analyst Nevan Beal and security researcher Sam Decker. "Within hours, that research had been turned into a multi-threaded validation tool that was reviewed, tested, and run against progressively larger target sets."

Two open-source tools formed the backbone of the AI infrastructure. Hindsight provided a persistent memory service for AI agents while AionUi delivered a unified graphical workspace to run and view multiple agents simultaneously. Together they enabled a feedback loop that preserved context across every stage of the campaign — a capability that fundamentally changes the economics of running a sustained attack operation.

Adaptive Targeting at Machine Speed

The targeting pipeline itself was automated through recovered source code that merged multiple source lists, geolocated candidates, filtered them by country, and identified live PaperCut systems before advancing. Targets were then categorized by operating system and environment. Failures were logged and used to adapt the framework's approach in subsequent waves rather than treating every unsuccessful attempt as an identical problem.

The adversary attempted to exclude entities in 28 countries from the attack, including Russia, China, Hong Kong, Iran, and Venezuela. However, GreyNoise noted that "the attempted restraint failed in some instances" — a reminder that even deliberately scoped AI-driven campaigns can exceed their intended boundaries.

This level of adaptive, self-correcting automation is precisely why proactive threat management strategies are no longer sufficient when built solely around known attack signatures and manual review processes.

---

What This Means for the Future of Cybersecurity

Unclear End Goals, Unambiguous Warning Signs

The attacker's end goals remain unclear. "It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses to achieve follow-on objectives such as data theft or ransomware deployment," GreyNoise stated. Beal added that while the methodology is consistent with initial-access activity, there is not yet sufficient evidence to confirm whether the actor is operating as an initial access broker.

A Structural Shift in Attack Economics

Blackpoint was direct in its assessment of what this campaign signals for the broader security landscape. "The strongest AI impact in this campaign was not a novel exploit technique. It was the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems."

This shift has profound economic implications for cybersecurity. What once required large teams of skilled operators can now be coordinated by a single actor with access to AI tooling and open-source offensive frameworks. The barrier to mounting a high-volume, adaptive attack campaign has dropped significantly — and that compression of cost and complexity is the defining threat of this new era.

The risks extend well beyond any single software vulnerability. Organizations evaluating their exposure should consider the broader risks and challenges AI introduces across business operations, particularly as adversaries begin exploiting the same tools enterprises are adopting for productivity.

Immediate Steps for Organizations Running PaperCut

Organizations running PaperCut NG/MF should patch CVE-2026-81578 and CVE-2026-82078 immediately and audit their systems for signs of compromise, including:

• Unexpected Windows registry activity
• Meterpreter payloads or Metasploit-related Java artifacts
• Unauthorized domain enumeration consistent with SharpHound or Certipy usage
• Anomalous Active Directory queries or lateral movement indicators

For a broader understanding of this class of attack, the MITRE ATT&CK framework provides detailed documentation of the techniques — including credential dumping, discovery, and lateral movement — observed throughout this campaign.

Building Defenses for an AI-Enabled Threat Environment

For businesses and institutions, this attack underscores the urgent need to move beyond reactive patching toward continuous exposure management. Knowing which vulnerabilities are actively exploitable in your specific environment before an attacker does is no longer optional.

Investing in AI-aware detection tools that can identify agentic attack patterns will be a defining capability for defenders in the months ahead. Security teams must also reckon with the reality that the feedback loops AI agents create — logging failures, revising code, retrying at scale — mean that traditional perimeter defenses and signature-based detection will consistently lag behind the operational pace of AI-assisted adversaries. The organizations that close this gap earliest will be the ones best positioned to absorb and respond to the next campaign of this kind.