Russian-Speaking Attacker Turned AI Agents Loose on PaperCut, Hit 395 Organisations in Days
Hundreds of AI agents built exploits, picked targets and broke into schools and businesses across 48 countries. One US high school went from first contact to full takeover in seven minutes.
Key points
- A Russian-speaking attacker used hundreds of AI agents to attack PaperCut print-management servers, breaking into 395 organisations across 48 countries starting 31 August.
- The agents exploited two PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, stealing passwords from 280 victims and full admin control at 12.
- Education was the hardest-hit sector; the United States was the top target, followed by the UK, France, Spain and Canada.
- In one US high school the attacker went from first break-in to full network takeover in seven minutes.
- PaperCut has issued emergency fixes and admins are told to patch immediately.
An attacker who appears to speak Russian pointed a swarm of AI agents at a piece of software most people have never heard of, and used it to break into hundreds of schools and companies in days.
The software is PaperCut NG/MF, a print-management product that sits on a server inside a company's network and tracks who prints what. It often runs with high privileges, so breaking into a PaperCut box is frequently a shortcut to the rest of the network.
What did the attacker actually do?
Threat intelligence firm GreyNoise, which first reported the operation on this subject we've tracked since 27 August, says the campaign began 31 August and hit at least 440 PaperCut servers belonging to 395 different organisations across 48 countries. The AI agents were wired up to OpenAI's Codex model and to DeepSeek, plus a scanning service called Netlas that finds internet-exposed servers, with off-the-shelf hacking tools doing the rest.
The two flaws are CVE-2026-81578 and CVE-2026-82078, both already flagged as under active attack earlier this month. They let an unauthenticated attacker run arbitrary commands on a vulnerable PaperCut server.
The failure mode here is familiar: an obscure business app, deep inside the network, with admin rights nobody thought about.
How fast was it?
GreyNoise clocked the attacker going from an empty workspace to a first successful remote code execution in under four hours. First full domain takeover came two hours after that. Once the campaign was live, 11 organisations were breached in 26 seconds. One US high school went from initial break-in to full domain administrator, meaning total control of the school's Windows network, in seven minutes.
Humans don't respond in seven minutes. That's the operational problem.
Who got hit?
| Metric | Figure |
|---|---|
| Organisations breached | 395 |
| PaperCut servers compromised | 440 |
| Countries affected | 48 |
| Credentials stolen from | 280 victims |
| OS or domain secrets taken from | 147 victims |
| Full admin control at | 12 organisations |
About half of the victims were in education. The attacker told the AI agents to skip Russia, China, Iran, Ukraine, Belarus, Moldova, Brazil and South Africa, though the agents didn't consistently follow those rules. An early sign that outsourcing your ethics module to a language model isn't reliable.
Should ordinary people worry?
If your school, college or employer used PaperCut and hasn't patched, staff passwords and internal files may already be gone. GreyNoise couldn't confirm the end goal, but this kind of access is normally sold on or used to deploy ransomware, malicious software that locks up files until a payment is made.
Watch for a password-reset notice from your school or workplace soon. If you reused that password elsewhere, change it now.
What should admins do right now?
Apply PaperCut's emergency updates for both CVEs today. Assume any PaperCut server facing the internet before 31 August is already touched. Hunt for the post-exploitation toolkit: Mimikatz, BloodHound, Rubeus, Impacket, NetExec, Certipy, Ligolo-ng and custom Rust credential collectors. Check domain controllers for a fresh account added to Domain Admins, and look for DCSync activity against your NTDS.DIT, the file containing every domain credential.
The post-mortem will say the print server was a domain admin and nobody noticed. It always does.
