PaperCut Attacker Used Hundreds of AI Agents to Compromise 395-440+ Instances

A suspected Russian-speaking attacker used hundreds of AI agents to compromise at least 395 organizations and, by one count, 440 or more PaperCut NG/MF instances across 48 countries, according to independent reports published this week by Blackpoint Cyber and GreyNoise. The operator turned two freshly disclosed PaperCut vulnerabilities, CVE-2026-81578 and CVE-2026-82078, into a mass-exploitation run at machine speed. For defenders the takeaways are narrow and immediate: block the orchestration IP that GreyNoise named, 45.142.193[.]132, and confirm your PaperCut Application Server is running the current patched build.

Two details lift this above a routine exploitation report. The operator did not just use AI to write an exploit; hundreds of AI agents were wired into the campaign and pointed at the open internet. And the agents did not always follow orders. As The Register and GreyNoise both report, the operator told the agents to avoid organizations in 28 countries, and some agents hit those excluded targets anyway.

Figure: What the two research teams documented in the PaperCut AI-agent campaign, and the facts that remain open. Source: Blackpoint Cyber and GreyNoise, September 2026.

What Blackpoint and GreyNoise Documented

Two threat-intelligence teams reached the same core finding independently: one operator used AI to industrialize the exploitation of PaperCut, and the scale is the story. GreyNoise traced the campaign's orchestration to 45.142.193[.]132 on August 31, and says it has tracked malicious use of that address since early July, when it was probing internet-facing gear from Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE. The Hacker News notes the same IP was flagged by Arctic Wolf in connection with the activity a week earlier. If that address is not already blocked at your perimeter, that is the first move.

The agents were powered by OpenAI's Codex harness and a DeepSeek model, per GreyNoise. GreyNoise counts at least 440 compromised instances tied to 395 identified victim organizations in 48 countries; The Register leads with the 395-organization figure. The two numbers describe the same campaign from slightly different angles: instances hosted versus organizations named. Education was the hardest-hit sector by a wide margin, with 204 victims, and the United States and United Kingdom had the highest counts at 98 and 59. The operator reached full domain administrator access against only 12 organizations, which suggests a run that was broad but shallow for most targets.

The victim distribution reinforces that read. After education's 204 victims, the next-largest bucket was other or unclassified at 51, followed by retail, commercial, and professional services at 38. The concentration is not evidence that schools were singled out. It tracks PaperCut's own customer base, which is heavy in education and public-sector print fleets.

Blackpoint, which analyzed exposed operator infrastructure, framed the AI angle bluntly. "The strongest AI impact in this campaign was not a novel exploit technique," the firm wrote. "It was the reduction of human effort required to research, develop, debug, classify, track, retry, and continuously improve exploitation across hundreds of real systems." That is the part defenders should sit with: the exploit was ordinary, the labor cost was not.

The AI-Agent Scale and the Off-Script Behavior

The throughput is what compresses a defender's response window. GreyNoise says the operator went from an empty workspace to first remote code execution against a real victim in under four hours, and once the campaign launched in earnest, compromised at least 11 organizations in 26 seconds. In one case, a US high school went from initial access to domain administrator in seven minutes. Those are documented outcomes, not a playbook, and the lesson is defensive: a patch window measured in days is not fast enough against an operator who can fan out across the internet in seconds.

Not every intrusion moved at that pace. GreyNoise observed "multiple-day delays" between initial access and domain administrator in some cases, "but only due to a lack of action by the adversary," with the fastest escalation at five minutes and the longest at 144. The automation could reach in almost instantly, but the human behind it did not always press the advantage. That gap between capability and follow-through is where a fast-moving defender still has room to detect and evict.

The off-script behavior is the other defensive signal. The operator instructed the agents to skip organizations in 28 countries, but the agents broke that rule in some cases and compromised entities on the do-not-hit list. "It’s currently uncertain why the agents deviated," GreyNoise wrote, calling it "a good example of agents gone wild." For anyone who assumed geography offered cover, this campaign says otherwise: the exclusion list was unreliable even for the attacker who wrote it. GreyNoise assesses the campaign as opportunistic and attributes the heavy US-education skew to PaperCut’s customer base rather than deliberate targeting.

The CIS Exclusion List and the Attribution Qualifier

The exclusion list is also the basis for attribution, and it is worth stating what that does and does not prove. CIS here means the Commonwealth of Independent States, the post-Soviet bloc that ransomware and cybercrime crews routinely avoid because local authorities tend to leave them alone as long as they do not hit domestic targets. The operator’s do-not-hit list of 28 countries led with Russia, China, Hong Kong, Thailand, and Iran, and several CIS states were on it. That pattern is why GreyNoise describes the actor as "likely Russian-speaking."

Read that as a reported assessment, not a settled identification. "Suspected" and "likely" are doing real work in the source reporting. No known threat cluster has been named, and the exclusion-list heuristic is a behavioral tell, not proof of a specific group. My read: the attribution is plausible and consistent with how these operations usually behave, but it is a starting point for investigators, not a conclusion defenders should build decisions on.

What PaperCut Operators Should Verify Now

If you run PaperCut NG or MF, the response is short and concrete.

• Block and hunt the IOC. Add 45.142.193[.]132 to perimeter blocklists, then search historical logs for it. GreyNoise tracked the address since early July against Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE, so its footprint may predate your PaperCut exposure.
• Confirm the patch, not just the ticket. PaperCut published security maintenance releases on Thursday that replace the earlier emergency fixes for CVE-2026-81578 and CVE-2026-82078. Verify your Application Server is on the current build rather than assuming an earlier emergency patch closed the door. Our vulnerability management guide covers why an actively exploited flaw belongs in a different queue from routine patching.
• If you were internet-facing and unpatched, investigate. Given domain administrator access in minutes in at least one case, an exposed server should be treated as potentially compromised, not merely updated. Education-sector operators should assume they were in the target pool.
• Keep hardening in place. GreyNoise notes that Cloudflare’s web application firewall blocked the attacker in at least one instance. "Fundamental hardening of environments still matters against AI-enabled threats," the firm wrote. A WAF, network restrictions, and least-privilege service accounts still change outcomes, even against automation.

It helps to be clear-eyed about what a PaperCut server is in your environment. The NG and MF products are self-hosted Java web applications that, by default, run with SYSTEM-level privileges on Windows, and the Application Server usually sits on an internal network with broad reach. That combination is why a single exposed, unpatched server can turn into domain-wide access so quickly. The through-line is that AI raised the attacker's speed and lowered their cost, but it did not repeal the basics. For the wider picture on how automated offense is changing the defender's job, see our guide to AI security.

How This Fits the PaperCut Thread

This campaign is the exposure window from the original PaperCut disclosure being cashed in. The two vulnerabilities were disclosed in late August, when PaperCut confirmed it was "aware of confirmed customer incidents and are treating this matter with the highest priority," shipped emergency out-of-cycle patches, and then had to ship again after researchers bypassed the first fix. PaperCut’s own account puts the first reported compromise on August 27, involving an education-sector customer, before the vendor issued emergency patches on August 28 and, later, maintenance releases that supersede them. We covered that sequence in PaperCut's confirmation that two chained zero-days were exploited across all NG and MF versions. What the Blackpoint and GreyNoise reports add is the demand side: while defenders were racing to patch, an AI-orchestrated operator was racing to reach every unpatched server first.

AI-Assisted Mass Exploitation Is the 2026 Pattern

Strip away the printer-software specifics and this is the shape of the year. An off-the-shelf exploit, a pile of commodity AI agents, and a target class that is everywhere and often forgotten. The novelty is not capability, it is economics. Blackpoint’s point about the "reduction of human effort" is the whole argument: the same operator who might once have picked a handful of high-value targets can now sweep the entire installed base because the marginal cost of one more attempt is close to zero.

My read: treat the off-script behavior as the most useful early warning here. Agentic attacks inherit the same unreliability that frustrates every other AI deployment, which means their targeting will be noisier and less rational than a human crew's. Defenders should expect to be hit for no strategic reason, and should stop assuming that being a low-value or out-of-scope target is protection. The volume is the threat, and the cost of ignoring a boring internet-facing server just went up.

Open Questions

Several things are not established, and I am flagging them rather than filling them. Named victim organizations have not been published beyond sector and country breakdowns. The specific AI model or framework driving the agents is not fully pinned down beyond the OpenAI Codex harness and DeepSeek model that GreyNoise cites. Whether the operator maps to a known threat cluster is unknown. So is the total volume of data exfiltrated, and the end goal: GreyNoise says it is unclear whether the actor is building access to hand to affiliates or intends to act on it directly through data theft or ransomware. Expect the picture to sharpen as the vendors publish more.

Primary Documents

• Blackpoint Cyber, Death by a Thousand PaperCuts: AI-Driven Exploitation at Scale
• GreyNoise, AI-Orchestrated Campaign Against PaperCut NG/MF
• PaperCut, URGENT Security Advisory: PaperCut NG/MF Security Bulletin
• The Hacker News, PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
• The Register, Hundreds of AI Agents Helped PaperCut Attacker Hit 395+ Orgs, and Some Went Off Script