GreyNoise says a Russian-speaking actor pointed hundreds of AI agents at PaperCut NG/MF and took 440 servers in 48 countries. The patch had been out for three days before the campaign even started.
What happened
Two PaperCut NG/MF bugs went public on 27 August: an auth bypass (CVE-2026-81578) and an unsafe-reflection RCE (CVE-2026-82078). The vendor shipped a fix the next day. Most shops would call that a good week disclosure to patch in 24 hours.
It didn't matter. On 31 August, GreyNoise watched an operator go from an empty workspace to remote code execution against a real, unpatched victim in under four hours, then to domain admin two hours after that. Once the campaign was actually running, eleven organizations fell in 26 seconds. Not 26 minutes.
The work was split between a person and a swarm. The human built a private lab — a copy of PaperCut, an Active Directory box — and worked out the exploit chain by hand. Then hundreds of AI agents, running on an OpenAI Codex harness with a DeepSeek model behind it, took the target list and did the rest: scan, exploit, dump credentials, try for the domain. The target list itself came from Netlas.io, an internet-scanning service, through an API key the operator had already had access to.
Why the agents beat your patch window
PaperCut runs as SYSTEM on Windows and sits domain-joined more often than not. That's the whole draw for an attacker , it's a printer utility with a straight line to Active Directory. Once the agents were in, they reached for Mimikatz, SharpHound, Certipy, Rubeus, Impacket, NetExec, and Seatbelt nothing exotic, all commodity red-team tooling. The AI didn't write new malware. It just ran the old playbook against 440 targets at once, without getting tired or waiting for a human to approve the next step.
Domain admin wasn't automatic. Credentials came out of 280 of the compromised hosts, and secrets off roughly 147, but the attacker only reached domain admin at 12 organizations one of them a US high school, in seven minutes flat. Everywhere else, the print server got popped and the campaign stalled, mostly because nobody on the other end told an agent to keep going. That gap is the only reason this isn't a much longer list.
Education took the worst of it 204 of the 395 identified victims. The US led on raw count with 98, the UK next at 59. GreyNoise also says the operator tried to steer clear of targets in 28 specific countries and missed that mark more than once. Scale finds the exceptions you didn't code for.
What a finding should say
"PaperCut needs patching" was true on 27 August and useless by 31 August. If you run PaperCut NG/MF, the finding you actually need says: which host, which build, whether it's domain-joined, and whether the account it runs under has any business being a Domain Admin service account. That last one is how two of GreyNoise's three observed escalation paths worked the PaperCut box was already sitting on a service account with too much reach, so the attacker didn't have to steal admin. It was just sitting there.
If your patch SLA is measured in days, this campaign already beat it, and it beat the vendor's own 24-hour turnaround too. The fix isn't a faster patch. It's not putting print management on a service account that can touch the domain controller, and it's having something watching for a new local admin appearing on a print server at 3 a.m. because by the time a person checks the weekly report, the agents have already moved on to the next 439 targets.
We watch that gap for clients who'd rather not find out from GreyNoise's blog. If you're running PaperCut, or anything else domain-joined and internet-facing, request a quote for host telemetry and monitoring on the boxes patch day doesn't cover.
Sources
- Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF — GreyNoise, 9 Sept 2026
- AI-powered attack exploited PaperCut flaws to hack 395 organizations — BleepingComputer, 10 Sept 2026
- Hackers Deploy Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers — CyberPress, 10 Sept 2026