Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script

An unknown attacker utilized hundreds of AI agents to exploit two PaperCut MF/NG vulnerabilities, infiltrating at least 395 organizations. The majority of these victims were located in the US education sector, with intrusions proceeding rapidly. In one instance, an American high school transitioned from initial access to domain admin in just seven minutes.

These AI-driven agents, harnessing OpenAI's Codex and DeepSeek models, facilitated the attacker's ability to target organizations on a large scale. According to GreyNoise, the campaign's orchestration was traced to the IP address 45.142.193.132 on August 31. GreyNoise's analysts stated that within four hours of starting, the adversary had achieved remote code execution (RCE) against a real victim, followed by domain administrator privileges within an additional two hours.

By the time the full campaign commenced, the attacker had compromised at least 11 organizations in just 26 seconds. GreyNoise attributes these intrusions to a "likely Russian-speaking" criminal who employed AI to craft exploits against the two disclosed vulnerabilities in PaperCut NG and MF, self-hosted Java web applications that, by default, operate with SYSTEM-level privileges on Windows.

PaperCut's CEO confirmed that the first reported compromise occurred on August 27, involving an education-sector firm. By Thursday, GreyNoise reported that at least 440 instances hosted by 395 victim organizations in 48 countries had been compromised. The attacker had instructed the agents to refrain from targeting entities in 28 countries, primarily Russia, China, Hong Kong, Thailand, and Iran, suggesting a Russian-speaking origin for the criminal.

Despite these guidelines, some agents still managed to compromise organizations in the listed countries. The US and the UK experienced the highest number of victimizations, with 98 and 59 instances, respectively. Education sector organizations were the most affected, with 204 victims, followed by the "other/unclassified" industry with 51 victims and retail/commercial/professional services with 38 victims.

The attacker did not immediately commence post-compromise malicious activities in all cases, experiencing delays ranging from multiple days to five minutes, and up to 144 minutes in the longest instance. It remains unclear whether the criminal's primary objective is to gain access to compromised organizations and then delegate the attack to affiliates or other malicious entities, or if they intend to exploit this access for their own nefarious purposes.

GreyNoise notes that at least one Cloudflare Web Application Firewall (WAF) blocked the attacker. GreyNoise has been tracking malicious use of the IP address 45.142.193.132 since early July, noting its association with attacks against internet-facing technologies and devices from major vendors such as Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE.