Case 04DeepSeek / PaperCut

AI-assisted PaperCut attacks compromised 395 organizations, GreyNoise reports

GreyNoise counted at least 440 server instances at 395 organizations in 48 countries. The victim count remains attributed to the investigating firm.

Affected system: PaperCut NG/MF print-management servers
Case status: Reported compromise; victim confirmation incomplete
Sources checked: 31 Oct 2026
Evidence: Incident sources / Oversight

Overview

An attacker used a DeepSeek model through the Codex harness to compromise PaperCut print-management servers, GreyNoise reported on September 9. Its account places the campaign on August 31; the model was not supplied by OpenAI. S001

Provisional impact: Critical, 4 of 4, based on widespread reported compromise. The victim count remains attributed to the investigating firm.

Reported impact

GreyNoise counted at least 440 server instances at 395 organizations in 48 countries. It observed domain-administrator access at 12 organizations, a narrower and more consequential outcome than initial server access. S001

What happened

Blackpoint investigated an attacked PaperCut server and traced the activity to exposed operator infrastructure. Recovered project files documented AI-assisted research, debugging and repeated attack attempts. Human instructions remained part of the process; the evidence does not establish a fully autonomous campaign. S003

GreyNoise also observed a failed attempt stopped by a web application firewall. Successful attacks were not universal. S001

Hunt.io says it recovered the operator's working files from three open directories on the same server. It reports that an instruction file named the Codex harness and a DeepSeek model and told the AI agent to keep trying after failures and to run up to 25 subagents at once. Hunt.io says the logs show little human intervention between steps. S008

How the boundary failed

Unauthenticated request → changed server configuration → attacker code execution → further credential access.

PaperCut identifies an authentication bypass, CVE-2026-81578, and unsafe class loading, CVE-2026-82078. Combined, these flaws allowed execution within the server process. The credential-access stage is documented in the campaign investigation. S002 S003

According to Hunt.io, the attacker's notes record a second route through PaperCut's XML-RPC interface that did not use the CVE-2026-81578 Tapestry bypass. The route still required XML-RPC authentication; Hunt.io says it depended on reachable API access and a valid token, which could be the built-in administrator password when no explicit API token was configured. Hunt.io does not report its use against real victims. S008

Consequences

Privileged credential access extended the attack beyond print management. The public evidence does not establish total financial loss or subsequent ransomware deployment. Victim identities and current containment remain incomplete. S001

Hunt.io says the attacker's files listed 45 targets with a working tunnel into internal networks at the time of capture and 46 Active Directory domains in packaged victim kits. These are Hunt.io's counts from the attacker's files, not a separate victim total. S008

The documented web and targeted SEC searches through October 31 found no ransomware, extortion, arrest, indictment, SEC 8-K or named-victim disclosure tied to this campaign; no full sweep of state breach portals or SEC EDGAR filings was performed.

Vendor response

PaperCut's September 10 advisory recommends maintenance releases 26.0.5, 25.0.13 or 24.1.10. These supersede its emergency patches. It also directs customers to restrict exposed interfaces and investigate compromise. Blackpoint recommends checking systems beyond the print server when exploitation is suspected. Published remediation is not proof that affected customers have completed it. S002 S003

As of October 31, PaperCut's August 27 advisory still showed September 10 as its last update. No PaperCut statement on Hunt.io's XML-RPC route, or the promised technical retrospective, was found in the checked PaperCut advisory, security-bulletin index, vulnerability log, news index or documented web searches. S002 S004

Timeline

August 27, 2026, AEST
PaperCut received a customer compromise report, preceding the documented AI campaign.
Evidence: S004
August 31
Earliest recovered campaign activity.
Evidence: S003
September 9
GreyNoise published its campaign findings.
Evidence: S001
September 10, AEST
PaperCut published standard security maintenance releases.
Evidence: S002
October 15, 2026
Hunt.io published its analysis of the operator's exposed files.
Evidence: S008

Incident sources

S001 · Agents Gone Wild: PaperCut campaignGreyNoise; primary · 2026-09-09
S002 · Urgent PaperCut NG/MF security advisoryPaperCut; primary · 2026-08-27
S003 · Death by a Thousand PaperCutsBlackpoint Cyber; primary · 2026-09-09
S004 · Behind the scenes: August security incidentPaperCut; primary · 2026-09-01
S005 · Known Exploited Vulnerabilities catalogCISA; primary · 2026-08-31
S006 · PaperCut security advisory AV26-858, Update 2Canadian Centre for Cyber Security; primary · 2026-08-28
S007 · Active exploitation of PaperCut MF and NGNetherlands NCSC; primary · 2026-08-28
S008 · Inside a PaperCut Attacker's AI ToolkitHunt.io; primary · 2026-10-15 · Full page read; counts describe attacker files at capture time; underlying attacker files and victim data not independently inspected

PaperCut's two documents share one vendor lineage. Hunt.io analyzed the same operator server as GreyNoise and Blackpoint; its figures describe the attacker's own files, not a separate victim count. Government alerts establish vulnerability-response actions, not independent confirmation of GreyNoise's campaign totals.

Official oversight

Checked October 31. The following actions address the vulnerabilities; they do not attribute this AI-assisted campaign.

Authority	Action	Status / basis	Next step	Source
US CISA	Added both CVEs to KEV on August 31, with September 14 due dates.	Exploited-vulnerability catalog; ransomware use listed as Unknown.	Follow the catalog's applicable remediation requirements.	S005
Canadian Cyber Centre	Updated AV26-858 on August 31.	Advisory recommending updates.	Apply vendor guidance.	S006
Netherlands NCSC	Issued an August 28 alert.	Warning of active exploitation.	Patch and check for compromise.	S007

Hunt.io says it gave recovered victim data to national computer emergency response teams, which are notifying affected organizations. No public national-CERT statement confirming those notifications was found in the documented searches through October 31. S008

What remains open

Established in this record

The vendor acknowledges exploitation. Three investigative teams describe the campaign; its global scale remains GreyNoise's finding.

Still unknown

Which victims remain exposed, whether the 45 internal tunnels Hunt.io found were later removed, whether the XML-RPC route was used against real victims, and how much control the operator delegated to agents.

Next reporting step

Seek national CERT or victim statements on notification and containment, and PaperCut's response to the XML-RPC route, without equating patch installation with removal of attacker access.

Record updates

October 31, 2026: Added Hunt.io's October 15 analysis of the operator's exposed files, including AI-agent instructions, a second access route through PaperCut's XML-RPC interface that Hunt.io says still required API authentication, and Hunt.io's count of 45 targets with live reverse SOCKS5 pivots at the time of capture. Corrected publication dates for the Blackpoint (September 9) and PaperCut blog (September 1) sources. As checked on October 31, PaperCut's August 27 advisory and CISA's catalog entries are unchanged. The severity assessment is unchanged.
September 12, 2026: Initial research draft. Includes vendor remediation and official vulnerability alerts; victim totals remain attributed.