PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances.

According to independent reports from Blackpoint Cyber and GreyNoise, the activity originates from "45.142.193[.]132," an IP address that has been linked to unauthorized port scanning and brute-force attack attempts in recent weeks. It's worth noting the same IP address was also flagged by Arctic Wolf in connection with the exploitation activity last week.

"At this time, we cannot confirm the exact end goal of this campaign," Nevan Beal, principal MDR analyst at Blackpoint, told The Hacker News. "The threat actor's methodology is consistent with initial-access activity, but we do not yet have sufficient evidence to confirm whether they are operating as an initial access broker."

At its core, the opportunistic attacks exploit CVE-2026-81578 and CVE-2026-82078, a combination of an authentication bypass and remote code execution chain, to mainly target the education sector in the U.S., the U.K., France, Spain, Canada, Belgium, Portugal, Australia, Germany, and Switzerland.