Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF GreyNoise September 9, 2026 GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. GreyNoise has been tracking malicious use of 45.142.193.132 since early July 2026 due to its use for attacks against internet facing technologies and devices from Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE. On 31 August 2026, a likely Russian-speaking malicious cyber actor (MCA) used 45.142.193.132 and artificial intelligence (AI) to develop, test, and use exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). PaperCut is print management software that enables organizations to track, charge, and manage printing, copying, and scanning jobs for organizations. PaperCut offers cloud and self-hosted versions. PaperCut NG and MF are self-hosted Java web applications that by default run with SYSTEM-level privileges on Windows and are usually domain-joined and integrated with Active Directory. As part of the adversary’s exploit development and testing, they built and attacked a lab environment that included the vulnerable PaperCut software and an Active Directory server. In parallel workflows, the adversary built target lists using an internet scanning service Netlas.io using an identified API key. Once the adversary achieved remote code execution (RCE) and credential harvesting in its self-hosted lab environment, they used hundreds of AI Agents powered by OpenAI’s Codex (harness), a DeepSeek model (not OpenAI models), and various publicly available offensive security tools to opportunistically compromise at least 440 instances of PaperCut MF/NG hosted by 395 identified victim organizations in 48 countries. There are other real victims that could not be attributed to a named organization. The adversary did explicitly attempt to avoid targeting entities in 28 identified countries; however, our observed victimology shows the attempted restraint failed in some instances. It’s clear that large language models (LLM) are enabling adversaries to move at greater speed and scale. The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds. In one instance, the adversary went from initial access to full domain administrator in seven minutes against a high school in the United States. However, the adversary did not experience success evenly across all victims. GreyNoise observed the adversary achieved domain admin against only 12 victim organizations. The adversary did not immediately follow-up with all compromised victims, so there were multiple-day delays between initial access and achievement of domain admin but only due to a lack of action by the adversary. Where domain admin was achieved, the adversary’s fastest time was five minutes and the longest time was 144 minutes. At GreyNoise’s time of last observation, the adversary had not achieved domain admin against the other victims. In at least one instance of targeting a perceived vulnerable PaperCut instance, Cloudflare’s Web Application Firewall (WAF) defeated the adversary. Fundamental hardening of environments still matters against AI-enabled threats. It is unclear if this actor is solely focused on access development to be handed off to other affiliated actors or if they will directly leverage their accesses to achieve follow-on objectives such as data theft or ransomware deployment. In the past, other intrusions involving exploitation of PaperCut have led to extortion. GreyNoise partnered with industry leading incident response services organizations to conduct victim notifications around the clock. Incident timelineTLP:CLEAR PaperCut mass exploitation by an AI agent AI agents directed by a malicious cyber actor (MCA) used OpenAI's Codex with a DeepSeek model. 25 dated events on 4 daysUnauthorized accessSelect a date to read it. From its orchestration host, the MCA downloads the advisory and pre- and post-patch versions of the software, then searches the internet for public proofs of concept and exploits. Installer components for the vulnerable and patched versions are extracted and diffed. The exploits are tested against patched and unpatched servers in Africa. Aug 31, 2026 · 16:04:42 UTC MCA is prompted for permission to continue Aug 31, 2026 · 16:09:31 UTC Multi-threaded tool built Built to operationalize the previous findings in furtherance of the attack. 1,005 potential target addresses resolved to countries Using a downloaded IP2Location LITE DB1 country database. Aug 31, 2026 · 16:35:10 UTC Local lab built An Active Directory server and a vulnerable PaperCut server. Aug 31, 2026 · 16:46:47 UTC Target list refined Aug 31, 2026 · 16:58:46 UTC Target list refined again Aug 31, 2026 · 17:02:12 UTC Lab gains 8 fake Active Directory users Aug 31, 2026 · 18:39:39 UTCUnauthorized access First remote code execution on a real target Remote code execution and a shell on a real target in Australia. Aug 31, 2026 · 19:14:46 UTC Target list excludes 28 countries The MCA lists them in order, from Russia, China and Hong Kong to Namibia, Nigeria and Zimbabwe. Aug 31, 2026 · 20:50:00 UTC Per-target intrusion kits assembled Compartmentalized "Kali-ready" kits with post-exploitation connectivity scripts. A kit can also create an account and password and add it to Domain Admin. Using a specific Application Programming Interface (API) key. Sep 1, 2026 · 08:30:00 UTCUnauthorized access Agents launch the campaign via a second execution host Hundreds of SSH sessions to that host. Unauthorized access to 11 organizations in 26 seconds, credential harvesting within a minute, 78 in the first hour, 8 with Domain Admin. Sep 1, 2026 · 17:01:00 UTC Cloudflare's Web Application Firewall defeats the MCA Targeting a host behind Cloudflare fails. The MCA also notices performance issues and adjusts thread usage for targets in the United States. Sep 1, 2026 · 17:15:00 UTC Bug found and fixed automatically The campaign continues harvesting credentials. Sep 1, 2026 · 23:12:04 UTCUnauthorized access Last remote code execution of Sep 1 Unauthorized access to more than 223 PaperCut systems. Despite U.S. based frontier model guardrails, adversaries are using a variety of large language models to conduct intrusions globally AI enables fast and efficient complex orchestration of cyber operations; however, unless properly constrained, agentic operations can deviate from expected behavior and pose operational risk Organizations are not helpless against agentic attacks and traditional hardening does have a positive impact on the security posture of an organization Intrusion Attack Lifecycle Where domain admin was achieved, GreyNoise observed three attack paths: Attack Path A. If the compromised PaperCut host was a domain member, the adversary harvested LSASS process memory and registry secrets to recover privileged credentials to pass-the-hash to the domain controller. Attack Path B. In instances where the victim had not patched for CVE-2021-42278 and CVE-2021-42287, the adversary used a ‘noPac’ attack. Attack Path C. If the compromised PaperCut host was on the Domain Controller itself or running as a Domain-Admin service account, the adversary simply added its newly created account to Domain Admins. In all Attack Paths, the adversary used DCSync to create a full NTDS.DIT dump to exfiltrate the organization’s credentials. GreyNoise Community CTA Free community account Tell signal from noise, for free. Create a free GreyNoise account and start telling internet noise apart from real threats. No credit card required. 50 IP lookups a week, plus live dashboards and up to 3 alerts Weekly At The Edge Clear threat briefs and access to GreyNoise Experiments Sign up with a work email for 10-day lookback, bulk lookups, and API access Note that these IOCs are not exhaustive, the AI-enabled adversary continued to make necessary changes on the fly. GreyNoise will continue to add new IOCs on our GitHub. The MCA had a library of publicly available offensive security tools used to expand access to the enterprise environment. Note that not all of these tools were observed in active use during this campaign. This campaign appears to be opportunistic. There is a high concentration of U.S. based targets in the education sector; however, it’s likely that is more attributable to the customer base of PaperCut NG/MF. The adversary used a list of defined countries to avoid that existed from previous campaigns. It’s currently uncertain why the MCA’s agents deviated, but it is a good example of Agents Gone Wild. The countries to avoid in order were: Russia, China, Hong Kong, Thailand, Iran, Venezuela, Belarus, Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Moldova, Ukraine, Brazil, Vietnam, Indonesia, Pakistan, Tanzania, Bangladesh, Afghanistan, Turkey, South Africa, Namibia, Nigeria, and Zimbabwe. Volume by Country Country Victims Credential Harvesting OS / Domain Secrets Domain Admin United States 98 59 31 1 United Kingdom 59 40 20 3 France 31 23 12 1 Spain 31 20 8 — Canada 24 10 8 3 Belgium 16 13 8 1 Portugal 16 9 5 1 Australia 15 8 4 — Germany 15 8 2 1 Switzerland 14 9 1 — Italy 13 8 7 — Taiwan 12 11 10 — Singapore 11 10 1 — Netherlands 9 6 5 — South Africa 9 2 1 1 Sweden 8 5 3 — Brazil 5 2 0 — Malaysia 5 4 3 — Denmark 4 3 1 — Ireland 4 3 2 — New Zealand 4 3 1 — Argentina 3 1 0 — India 3 3 2 — Cambodia 2 2 2 — Chile 2 1 1 — Finland 2 1 1 — Greece 2 1 0 — Japan 2 0 0 — Puerto Rico 2 2 0 — Austria 1 1 0 — Botswana 1 1 1 — Bulgaria 1 0 0 — China 1 0 0 — Colombia 1 0 0 — Ecuador 1 0 0 — Estonia 1 1 1 — Kazakhstan 1 0 0 — Lithuania 1 1 1 — Mexico 1 1 1 — Namibia 1 1 0 — Nigeria 1 1 1 — Pakistan 1 0 0 — Philippines 1 1 0 — Poland 1 1 1 — Romania 1 1 1 — Saudi Arabia 1 1 0 — Sri Lanka 1 1 1 — Zimbabwe 1 1 0 — Total 440 280 147 12 Volume by Industry Industry Victims Credential Harvesting OS / Domain Secrets Domain Admin Education 204 129 67 7 Other / unclassified 51 32 18 1 Retail / Commercial / Professional services 38 28 16 2 Real estate / Coworking / Hospitality 29 20 6 — IT / MSP / Print reseller 25 17 8 — Non-profit / Religious / Charity 21 16 9 2 Unknown (unattributed) 15 6 3 — Library / Archive 13 9 8 — Manufacturing / Industrial / Energy / Utilities 13 7 3 — Government / Public sector 9 6 3 — Healthcare / Social care 8 3 2 — Legal 8 3 2 — Financial / Insurance 6 4 2 — Total 440 280 147 12 GreyNoise will continue monitoring the situation and report updates as needed. This article is a summary of the full, in-depth version on the GreyNoise Labs blog.