CTI · reviewed · 2026-09-20

AI-Orchestrated Campaign Against PaperCut NG/MF Exploiting CVE-2026-81578 and CVE-2026-82078

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1078 Valid Accounts Stealth

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: AI-Orchestrated PaperCut NG/MF Exploitation Campaign
id: a7e3c1d4-8f2b-4a9e-b5d6-1c8e7f3a2b4c
status: experimental
description: Detects exploitation attempts against PaperCut NG/MF print management servers via CVE-2026-81578 and CVE-2026-82078, as observed in the AI-orchestrated campaign documented by GreyNoise on August 31 2026.
references:
  - https://www.greynoise.io
author: Tia N. List
date: 2026-09-20
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_papercut:
    Image|endswith:
      - '\papercut-print-provider.exe'
      - '\papercut-print-monitor.exe'
      - '\pc-app-server.exe'
      - '\pc-sm.exe'
  selection_suspicious_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\java.exe'
      - '\javaw.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_papercut and selection_suspicious_parent
falsepositives:
  - Legitimate PaperCut administration via web console
level: high

References

• https://www.greynoise.io