CTI · reported · 2026-09-07

Hackers Exploit PaperCut NG/MF Flaws to Steal Credentials and Deploy Meterpreter

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1136 Create Account Persistence
• T1003 OS Credential Dumping Credential Access

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: PaperCut NG/MF Suspicious Account Creation - Administrator17
id: 9d9390d3-7e9e-4b3d-bc20-bf6be65a1c4c
status: experimental
description: Detects creation of the suspicious local account 'Administrator17' observed in active PaperCut NG/MF exploitation campaigns (CVE-2026-81578, CVE-2026-82078). Attackers create this account for persistence after initial exploitation.
references:
  - https://cyberpress.org
  - https://gbhackers.com
author: Tia N. List
date: 2026-09-07
tags:
  - attack.t1136
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID:
      - 4720
      - 4722
    TargetUserName|contains: 'Administrator17'
  condition: selection
falsepositives:
  - Legitimate administrative account creation (unlikely to use this exact name)
level: high

References

• https://cyberpress.org
• https://gbhackers.com