The step that decides how you hunt is the second one. Defused says the actor uses the authentication bypass to hijack PaperCut's external user-lookup and pull database tables out through Derby, which is not the remote code execution route shown in the public writeups [6]. Nothing spawns. A print server that never runs an unexpected child process can still be handing over its database, and detection content built against the RCE proof of concept is watching for the wrong artifact [16]. PaperCut shipped indicators of compromise alongside the fixes [3], but the vendor has not described what the intruders do after access [4], so whether those indicators cover the query path is something defenders have to check for themselves.
Scope, with the arithmetic shown. Shadowserver counts more than 800 PaperCut MF and NG servers reachable from the internet [8]. PaperCut says the software runs at more than 70,000 organizations and 100 million users [7]. That works out to roughly 1.1 percent [14], and it is the wrong denominator for risk. The 800 are the servers an attacker can reach with no foothold; the rest sit inside, where a pre-auth chain works as a lateral tool once someone is already on the network. Shadowserver's figure also includes honeypots and hosts that may already be patched [8].
The gap between fix and exploitation was short. The two emergency patch sets landed Thursday and Friday [3]. Defused recorded honeypot activity from late on August 29 UTC [5], about a day after the second set [15].
This is well-worn ground for the product. The April 2023 chain of CVE-2023-27350 and CVE-2023-27351 was tied to LockBit and Clop [9]. Microsoft reported two weeks later that MuddyWater and APT35 had joined in [10]. The FBI and CISA warned in May 2023 that the Bl00dy gang was using the same RCE bug for initial access [12], and CISA flagged CVE-2023-2533 as actively exploited in July 2025 [13]. Counting the current pair, that is three separate PaperCut bug sets exploited in the wild since 2023 [17].
What the 2023 crews wanted was Print Archiving, the feature that keeps a copy of every document sent through the server [11]. The draw has not changed much. A print server is a document store with a queue attached, and per Defused, the current activity is reading it [6].
