PaperCut Attacks Escalate: AI Agents Hit 395 Organizations

When we covered the PaperCut zero-days on August 31, the advice was about patching fast. A month later, the story is about the servers that weren't patched fast enough. Researchers have documented a single attacker using hundreds of AI agents to break into PaperCut print-management servers worldwide, some of those break-ins reached domain-admin level on the victims' Windows networks, and ready-made exploit code is now public.

If your office runs PaperCut NG or MF, the question has shifted from "did we patch?" to "were we already found?"

What's changed since the PaperCut zero-days were disclosed?

Three things: the attacks were automated at scale, PaperCut replaced its emergency patches with fully tested releases, and exploit code went public. None of it changes the underlying flaws, CVE-2026-81578 and CVE-2026-82078, but all of it shortens the time an unpatched server can expect to go unnoticed.

The fixes came in stages. On September 1, PaperCut shipped a third emergency patch that repaired two things the earlier patches broke, SAML single sign-on and legacy Microsoft SQL Server drivers used for external card lookup, and closed off more attack vectors seen in the wild, according to PaperCut's advisory, Arctic Wolf and eSentire. Tested maintenance releases followed; more on those below.

How did one attacker reach 395 organizations so quickly?

By delegating the work to AI. In research published in early September, threat-intelligence firm GreyNoise reported that a likely Russian-speaking actor used AI to develop and test exploits for the two PaperCut flaws, then turned hundreds of AI agents loose on internet-exposed servers. The agents ran on OpenAI's Codex harness with a DeepSeek model plus public offensive-security tools, as The Hacker News and Help Net Security also reported.

The tally: at least 440 PaperCut NG/MF instances compromised, belonging to 395 identified organizations in 48 countries, according to GreyNoise, SecurityWeek and Dark Reading.

The speed is the part worth sitting with. GreyNoise says the attacker went from an empty workspace to remote code execution on a real victim in just under four hours, and to the first Active Directory domain admin two hours after that. Once the full campaign was running, it compromised at least 11 organizations in 26 seconds, figures Dark Reading and Help Net Security also cite.

Twenty-six seconds is less time than it takes to find your copier dealer's phone number. The comfortable assumption that small offices have weeks before anyone gets around to them doesn't hold when the "anyone" is software running around the clock.

Who was hit hardest, and does that include small businesses?

Education, by a wide margin, though GreyNoise doesn't think the attackers were picking sectors. It counted 204 victim organizations in education, heavily concentrated in the United States, and attributes that to PaperCut's customer base rather than deliberate targeting, as Help Net Security and The Register reported.

That attribution is the useful part for a business owner. The campaign went wherever exposed PaperCut servers were. A law office, clinic or accounting firm with an unpatched, internet-reachable server was in the same pool as a school district, often with fewer IT staff to notice.

Why is a hacked print server now a whole-network problem?

Because the attackers didn't stop at the print server. According to GreyNoise, BleepingComputer and The Hacker News, they harvested credentials from compromised servers and pushed into Windows Active Directory, reaching domain-admin level at 12 organizations.

In plain terms: a print server joined to your Windows domain can hold reusable credentials in memory. Steal those, try them against the server that controls every account in the office, and you may end up controlling the whole network, not just the printers. Twelve out of 395 is a small fraction, but those twelve handed an attacker the keys to their whole domain.

Printers and print servers leaking Windows credentials isn't new; our explainer on pass-back attacks shows another route. What's new is the scale and the speed.

Which PaperCut version should you be running now?

A maintenance release, not an emergency patch. PaperCut has shipped fully QA-tested NG/MF releases 26.0.5, 25.0.13 and 24.1.10, which include every fix from Emergency Patch Releases 1 through 3 plus extra hardening, and it advises customers still running an emergency-patch build to move to one, according to PaperCut's 26.0 release history, The Hacker News and Arctic Wolf.

One practical snag: if your setup looks up users' cards or ID badges in an external database, PaperCut says that configuration must be reconfigured after upgrading. Ask whoever installed it to plan for that, so badge release doesn't stop working on upgrade day.

The version-23 row isn't a formality. PaperCut never issued emergency patches or maintenance releases for version 23 or earlier, as its advisory, Huntress and the Canadian Centre for Cyber Security all note.

Waiting is also riskier than it was in August. A Metasploit module from Rapid7 now implements the unauthenticated two-flaw chain against PaperCut 24.x, 25.x and 26.x, according to Rapid7, the Metasploit project and GBHackers, and Arctic Wolf notes that public exploit code is available. That puts the attack in off-the-shelf tools, so an unpatched server no longer needs a sophisticated attacker to find it.

What this means for San Fernando Valley offices

For a Valley office, the real question isn't only "are we patched?" It's "could anyone reach our PaperCut admin page from the internet between late August and the day we patched?" If the answer is yes, or "we don't know," treat the server as possibly compromised, not just out of date. A patch locks the door; it doesn't check whether someone is already inside.

That has a legal edge in California. Our August post explained SB 446's 30-day deadline for notifying affected Californians after discovering a breach of their personal information. The same law adds a second clock worth knowing: if more than 500 Californians are notified, a sample copy of the notice must go to the state Attorney General within 15 calendar days of notifying them, according to the bill text, The National Law Review and JD Supra. Because the 30 days run from discovery, a prompt, professional check of an exposed server beats months of not knowing.

If you run a private school, tutoring center or training program anywhere from Chatsworth to Studio City, the education numbers are a direct warning. If you run a law, medical or accounting office, the lesson is that attackers went wherever PaperCut was. Either way, check what your cyber insurance policy requires you to report, and when.

What to do now

1. Confirm your exact version. Ask your copier dealer or IT provider for the PaperCut NG/MF version number and compare it with the table above.
2. Get off emergency patches. Move to 26.0.5, 25.0.13 or 24.1.10 or later, and plan the external-database card lookup reconfiguration if you use it.
3. Upgrade or retire version 23 and older. There's no fix for those versions.
4. Keep the admin interface limited to trusted internal IP addresses. PaperCut's first piece of advice still applies after patching.
5. Hunt for signs of an earlier break-in. Check for PaperCut's published indicators, including a "Remote Access Service" running SimpleHelp's SimpleService.exe and unexpected AnyDesk installs, plus administrator or Domain Admin accounts nobody remembers creating.
6. Reset credentials if the server was exposed. Change the PaperCut service account password, any directory or database credentials stored in PaperCut, and domain admin passwords.
7. Don't run PaperCut on a domain controller or under a domain-admin account. Give it only the access it needs.
8. Bring in counsel and your insurer early if you find evidence of compromise.

Not sure which version you're on, or whether your print server was ever exposed? Book a free virtual consultation and we'll help you get a straight answer from your dealer and a plan sized for a small office.