GreyNoise: AI Agents Breached 395 Organizations Through PaperCut Print Software Flaws

A threat actor GreyNoise describes as "likely Russian-speaking" turned two software flaws in a print management program into a global breach of nearly 400 organizations, most of them schools, using AI agents that did the hacking on autopilot.

GreyNoise, a threat intelligence firm, published the findings Wednesday, September 9. The firm says the attacker combined OpenAI's Codex coding tool with a DeepSeek model and off-the-shelf hacking software to compromise at least 440 instances of PaperCut NG and MF at 395 identified organizations across 48 countries. The Hacker News reported independent confirmation from Blackpoint Cyber, which traced the activity to the same source IP address, 45.142.193.132.

The Flaw and Why It Was So Bad

PaperCut NG and MF are self-hosted print management programs used by more than 100 million people across roughly 70,000 organizations worldwide, according to Tech Times. Two things made this software a perfect target. By default it runs with SYSTEM-level privileges on Windows, the highest permission tier the operating system offers. And in most enterprise setups it's plugged directly into Active Directory, the system that manages every user account on a network.

The attacker chained two vulnerabilities to exploit that setup: CVE-2026-81578, an authentication bypass rated 8.8 out of 10 on the severity scale, and CVE-2026-82078, a remote code execution flaw rated 9.4, according to Tech Times. Both are listed in CISA's Known Exploited Vulnerabilities catalog. PaperCut issued emergency patches on August 28. Its CEO has said the first reported compromise came in the day before, August 27, meaning real victims were hit before a fix existed. PaperCut followed up with permanent security maintenance releases on Thursday, September 10, according to The Register.

From Empty Workspace to Domain Admin in Hours, Then Minutes

GreyNoise says the attacker built a private lab with a vulnerable copy of PaperCut and an Active Directory server to develop and test exploits, then used the Netlas.io scanning service to build target lists. From there, the numbers escalate rapidly.

The attacker went from an empty workspace to remote code execution against a real victim in under four hours, then to full domain administrator rights two hours after that, GreyNoise reported. Once the automated campaign launched at scale, it compromised 11 organizations in 26 seconds. In one case, a U.S. high school went from initial access to full domain admin in seven minutes, GreyNoise said. Where the attacker achieved domain admin elsewhere, the fastest run took five minutes and the slowest took 144 minutes.

Not every intrusion reached that level. GreyNoise counted 280 victims where credentials were stolen and 147 where operating system or domain secrets were pulled, but only 12 organizations saw full domain administrator access. In all cases, the agents used a technique called DCSync to pull a complete database of domain credentials, using tools including Mimikatz, Certipy, BloodHound, Rubeus, and Impacket, per Bleeping Computer.

Mostly Schools, Mostly the US

Education made up roughly half the victims, with Help Net Security putting the figure at 204 organizations. GreyNoise attributes that to PaperCut's customer base rather than deliberate targeting of schools. The United States was hit hardest, followed by the United Kingdom, France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland, according to The Hacker News.

A Do-Not-Hit List the Robots Ignored

The human operator told the AI agents to avoid roughly 28 countries, mostly former Soviet states plus China, Iran, and others, which is why GreyNoise concludes the attacker is likely Russian-speaking. It's a common pattern among criminal operations to avoid the countries where local authorities look the other way, The Register noted.

The agents didn't fully comply. Help Net Security reported that GreyNoise found victims in Russia, China, Kazakhstan, and Pakistan anyway, despite those countries being on the exclusion list. GreyNoise called it "a good example of agents gone wild" and said it's currently uncertain why the agents deviated from instructions.

The Fair Counterargument

Attackers have used automated scripts and scanning tools for years, and the underlying failure is an old one: internet-exposed software running with excessive default permissions on networks that hadn't patched a known, actively exploited flaw within days of a fix being released. On that view, AI didn't create the vulnerability. Careless deployment and slow patching did.

That's fair, but it doesn't erase what GreyNoise measured. Nevan Beal, principal MDR analyst at Blackpoint Cyber, told The Hacker News his firm "cannot confirm the exact end goal of this campaign" but that the methodology is "consistent with initial-access activity." Whatever the flaws' origin, the response window collapsed from what would have taken a skilled team days into a process that hit 11 fresh victims in 26 seconds once launched.

GreyNoise says it still doesn't know what the attacker wants the access for: data theft, ransomware, or resale to another criminal group as an initial-access broker. Blackpoint's Beal said there isn't yet enough evidence to say which. Any organization still running PaperCut without the August 28 emergency patch, or the September 10 maintenance release, doesn't have to wait for that answer to know what to do next.