Build1 publisher2 min readPublished
Exploit development for PaperCut took under four hours from an empty workspace
GreyNoise says a likely Russian-speaking actor built and tested PaperCut exploits in a lab, then ran hundreds of agents on a Codex harness with a DeepSeek model against 440 servers in 48 countries. The sending infrastructure was already on its watchlist.
The Engineer · Build desk
What happened
- GreyNoise had been tracking 45.142.193.132 since early July 2026 for attacks on internet-facing Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE systems before the same host turned to PaperCut.
- The actor built and attacked a lab containing vulnerable PaperCut software and an Active Directory server, reaching remote code execution and credential harvesting there before touching real targets.
- Hundreds of AI agents then opportunistically compromised at least 440 PaperCut MF/NG instances hosted by 395 identified victim organizations across 48 countries, plus victims GreyNoise could not name.
- GreyNoise clocked the actor from an empty workspace to RCE against a real victim in just under four hours, first domain admin two hours later, and at least 11 organizations compromised in 26 seconds.
- Cloudflare's web application firewall defeated the actor at one perceived vulnerable instance, and GreyNoise attributes the multi-day gaps at other victims to the adversary's own inaction.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint PaperCut's shipping default puts the print server inside the domain at SYSTEM, so applying the two patches does not close the path from web RCE to Active Directory. Removing that path is privilege and segmentation work on a machine most teams treat as an appliance.
- capability Refusal policy travels with the weights, so an operator can keep a US-built agent harness and point it at a model with different limits. Vendor-side guardrails constrain the model call. The tool loop around it belongs to the harness.
- exposure The actor's own exclusion list did not hold, so entities in the 28 countries it tried to avoid were hit anyway. Defenders in those countries could not rely on that list.
- decision Domain admin landed at a small fraction of victims. The stage where the agents actually performed was scan and RCE, so that is where the detection effort should go.
PaperCut NG and MF are self-hosted Java web applications that by default run with SYSTEM-level privileges on Windows, and the installs are usually domain-joined and integrated with Active Directory [4]. That default explains the target selection better than anything about the tooling does. A web-tier RCE on a print server lands as SYSTEM on a domain member, and credential harvesting follows from the same session.
The agents ran on OpenAI's Codex as the harness with a DeepSeek model behind it, explicitly not OpenAI models, alongside various publicly available offensive security tools [7]. GreyNoise wrote that this happened "Despite U.S. based frontier model guardrails, adversaries are using a variety of large language models to conduct intrusions globally" [18]. The harness supplies the file access, the tool invocation and the loop control.
Post-exploitation did not scale with the access. GreyNoise says the actor reached domain admin at 12 victim organizations [13] out of the 395 it identified [8], which is about 3% [21]. Where it worked the fastest run took five minutes and the longest 144 [14]. The seven-minute case was a high school in the United States [12].
The writeup gives no publication or patch dates for CVE-2026-81578 or CVE-2026-82078 [26], so nothing here measures the interval between disclosure and working exploit. The four-hour clock starts at an empty workspace. GreyNoise also says it is unclear whether the actor is developing access to hand to affiliated actors or intends to act on it directly, and notes that past PaperCut exploitation has led to extortion [19].
The sending infrastructure was already familiar. GreyNoise had been watching 45.142.193.132 for roughly two months before the PaperCut activity [23]. The same sensor grid that had logged this host against Palo Alto and Citrix gear caught it turning to PaperCut.
"Fundamental hardening of environments still matters against AI-enabled threats," GreyNoise wrote [17]. Its own second takeaway is narrower and more useful for anyone modelling this: unless properly constrained, agentic operations can deviate from expected behaviour and pose operational risk to the operator [27].
What to watch
- Publication or patch dates for CVE-2026-81578 and CVE-2026-82078. Those dates would let defenders measure the disclosure-to-exploit interval this writeup cannot.
- Follow-on activity at the 383 organizations where GreyNoise did not observe domain admin. That activity would settle whether this actor brokers access or uses it.
- Whether other sensor operators report the same Codex-harness-plus-third-party-model pattern from different infrastructure.