CTI · reported · 2026-09-10

AI-automated exploitation of PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078)

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1021 Remote Services Lateral Movement
• T1078 Valid Accounts Stealth
• T1087 Account Discovery Discovery
• T1136 Create Account Persistence

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: AI-Automated PaperCut NG/MF Exploitation Campaign
id: eaa18cff-0f2c-4851-bb79-2b89c7987c4c
status: experimental
description: Detects exploitation of PaperCut NG/MF authentication bypass (CVE-2026-81578) and unsafe reflection RCE (CVE-2026-82078) used in an AI-automated campaign that compromised 440 servers across 395 organizations. PaperCut commonly runs with SYSTEM privileges on Windows and integrates with Active Directory.
references:
  - https://www.greynoise.io
  - https://gbhackers.com
author: Tia N. List
date: 2026-09-10
tags:
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_papercut_process:
    Image|endswith: '\pc-app-server.exe'
    IntegrityLevel: 'System'
  selection_papercut_auth_bypass:
    Image|endswith: '\pc-app-server.exe'
    ParentProcessName|endswith: 'java.exe'
    CommandLine|contains: 'paperCut'
  selection_papercut_rce:
    Image|endswith: '\pc-app-server.exe'
    CommandLine|contains|all:
      - 'reflect'
      - 'invoke'
  condition: selection_papercut_process or selection_papercut_auth_bypass or selection_papercut_rce
falsepositives:
  - Legitimate PaperCut administration
level: high

References

• https://www.greynoise.io
• https://gbhackers.com