{"slug": "an-ai-agent-swarm-hit-440-papercut-servers-in-26-seconds-per-target-the-sector-a", "title": "An AI Agent Swarm Hit 440 PaperCut Servers in 26 Seconds Per Target. The Education Sector Didn’t Stand a Chance.", "summary": "A threat actor tracked by Huntress as UNC-PRNT used OpenAI Codex and DeepSeek models to build an AI-assisted offensive pipeline that compromised more than 440 PaperCut NG/MF instances across 395 organizations in 48 countries, with eleven victims falling in 26 seconds each. The campaign chained two PaperCut vulnerabilities — CVE-2026-81578, a pre-authentication RCE in the SetupCompleted API endpoint, and CVE-2026-82078, a post-authentication sandbox escape in the scripting engine — to gain unauthenticated SYSTEM-level code execution, and both were added to CISA's Known Exploited Vulnerabilities catalog by mid-September 2026. Huntress recovered the actor's workspace from a compromised staging server, showing four hours of AI-assisted development that automated scanning, exploitation, and payload delivery.", "body_md": "The attack didn’t start with a phishing email. It didn’t start with a social engineering call. It started with an empty AI coding workspace and four hours of prompt engineering.\n\nBy the time researchers at Huntress and GreyNoise caught up, 440+ PaperCut NG/MF instances across 395 organizations in 48 countries had been compromised. Eleven of those organizations fell in 26 seconds each. A high school in the southeastern United States went from initial access to full domain admin in seven minutes.\n\nSeven minutes. For a K-12 school district that probably hasn’t patched since the last ice age.\n\nThis is not a story about a sophisticated nation-state operation with custom tooling and zero-day chains. This is a story about a single threat actor who figured out that AI coding agents can compress an entire offensive kill chain into something that looks less like hacking and more like running a build script.\n\nTwo vulnerabilities. Both in PaperCut NG/MF, the print management software that runs in basically every school district, university, and mid-sized organization that still believes in printers.\n\nCVE-2026–81578 is a pre-authentication remote code execution vulnerability in the SetupCompleted API endpoint. PaperCut’s installer flow doesn’t properly validate whether initial setup has already occurred. An attacker can replay the setup sequence on a production instance and inject arbitrary code during the “configuration” phase. No credentials required. No user interaction. Just a crafted HTTP request to a predictable endpoint.\n\nCVE-2026–82078 is a post-authentication privilege escalation in the scripting engine. PaperCut exposes server-side scripting for workflow automation, and the sandbox around that scripting engine has holes you could drive a truck through. Once you have any authenticated session (which CVE-2026–81578 gives you for free), you can escape the script sandbox and execute operating system commands as the PaperCut service account, which on most deployments runs as SYSTEM or root.\n\nChain them together and you get unauthenticated remote code execution as SYSTEM on any internet-facing PaperCut instance. The patches dropped in late August 2026. By mid-September, CISA had both on the Known Exploited Vulnerabilities catalog.\n\nHere’s where it gets interesting. And by interesting, I mean deeply unsettling for anyone who’s been saying “AI-powered attacks are theoretical.”\n\nThe threat actor, tracked by Huntress as UNC-PRNT (not their most creative name), operates from infrastructure centered around 45.142.193.132, a Russian-hosted VPS. Language artifacts in the tooling, commit messages, and C2 panels are consistently Russian. The attribution isn’t bulletproof, but it’s solid enough that the National Crime Agency (NCA) issued a joint advisory with CISA.\n\nWhat makes UNC-PRNT different from every other actor exploiting print management software is the development process. Huntress recovered the actor’s workspace from a compromised staging server, and what they found was an AI-assisted offensive development pipeline.\n\nThe workspace contained interaction logs with both OpenAI Codex and DeepSeek models. The actor used Codex for generating initial exploit code, payload templates, and evasion routines. DeepSeek handled the more nuanced work: analyzing PaperCut’s Java bytecode, identifying sandbox escape vectors, and generating Mimikatz command sequences tailored to specific Active Directory configurations.\n\nThe timeline from the logs is alarming. Four hours of AI-assisted development produced:\n\nThe scan-to-shell pipeline was fully automated. Once the target list was compiled (GreyNoise observed mass scanning originating from six different VPS nodes), the exploit delivery was parallelized across all targets simultaneously.\n\nEleven organizations went from “no indication of compromise” to “attacker has a SYSTEM shell on the PaperCut server” in 26 seconds. That’s the time between the first network connection and the callback to the C2 infrastructure. The exploit, payload delivery, persistence installation, and initial beacon all happened in a single automated sequence.\n\nThe 26-second number includes network latency. The actual exploitation takes about 3 seconds on a responsive server.\n\nFor context, most SOC alert-to-triage workflows take 15 to 30 minutes. Even the best automated detection and response platforms need 60 to 90 seconds to correlate, alert, and initiate containment. The attacker’s entire initial access phase completes before the first SIEM rule fires.\n\nThe high school case study is the one that keeps coming up in the advisories, and for good reason. It’s the clearest demonstration of what happens when AI-compressed attack chains hit environments with minimal security controls.\n\n*Here’s the timeline Huntress published:*\n\nT+0s: CVE-2026–81578 exploit hits the PaperCut server. Setup replay triggers code execution.\n\nT+3s: CVE-2026–82078 escalates to SYSTEM. Fileless servlet filter installed for persistence.\n\nT+26s: C2 callback confirmed. Godzilla webshell and suo5 SOCKS tunnel established.\n\nT+45s: Mimikatz dumps credentials from LSASS. Service account passwords recovered in cleartext.\n\nT+2m 10s: SharpHound executes. Full Active Directory graph collected.\n\nT+3m 30s: Certipy identifies misconfigured certificate templates (ESC1). Certificate request submitted for Domain Admin.\n\nT+5m 15s: Rubeus uses the forged certificate to request a TGT as a Domain Admin.\n\nT+7m 00s: Attacker has Domain Admin. Golden ticket generated. Game over.\n\nThe school district had no EDR. Their antivirus was signature-based and hadn’t been updated in three weeks. The PaperCut server was directly internet-facing on its default port. The Active Directory had certificate templates from the default installation that nobody had ever audited.\n\nThis is not an unusual configuration for K-12. This is the median configuration.\n\nGreyNoise’s VP of research put it bluntly in their analysis: “The speed differential between AI-assisted offensive operations and human-driven defensive operations has crossed a threshold where traditional detect-and-respond models are structurally inadequate.”\n\nThat’s a polished way of saying: by the time your SOC analyst finishes reading the alert title, the attacker already owns the domain.\n\nThe traditional kill chain model assumes discrete phases with decision points between them. Reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Each phase historically involved human decision-making, manual tool configuration, and natural delays. Those delays were the defensive window.\n\nAI agent-assisted attacks collapse those phases into a continuous automated pipeline. There are no gaps to exploit because there are no humans in the loop during execution. The human makes decisions during development (the four-hour sprint), and then the entire kill chain runs as compiled automation.\n\nThis is fundamentally different from script kiddie automation or even conventional exploit kits. Previous automation handled one or two phases. AI-assisted development automates the entire chain, including the decision logic for branching based on target environment characteristics. The SharpHound output feeds into automated path analysis. The Certipy enumeration triggers specific Rubeus commands based on what certificate templates are available. Each step adapts to what it finds.\n\nIf you run PaperCut NG/MF in any capacity:\n\nPatch immediately. Versions 23.0.9+ and 22.1.7+ contain fixes for both CVEs. If you’re running anything older, you are actively being scanned right now.\n\nCheck for indicators of compromise. Look for the servlet filter persistence mechanism. PaperCut’s web application directory shouldn’t contain any .class files that weren’t part of the original installation. Compare against a known-good hash set from PaperCut’s distribution.\n\nAudit your Active Directory certificate templates. The ESC1 misconfiguration that enabled the seven-minute domain admin path exists in most default AD deployments. Run Certipy or PSPKIAudit against your own environment before someone else does.\n\nGet your PaperCut server off the public internet. There is no legitimate reason for print management software to be directly accessible from the internet. Put it behind a VPN or zero-trust access proxy. This alone would have prevented 90% of these compromises.\n\nDeploy EDR on print servers. The fact that print servers are traditionally treated as “infrastructure that doesn’t need endpoint protection” is exactly why they keep getting compromised. Treat them like any other server running as SYSTEM.\n\nThe Bigger Picture\n\nJADEPUFFER, which I covered last week, was the first autonomous AI ransomware. UNC-PRNT’s PaperCut campaign is something adjacent but distinct: it’s not an autonomous AI agent running the attack. It’s a human using AI agents to develop and automate the attack at a speed and scale that wasn’t previously possible for a single operator.\n\nThe distinction matters because the defensive implications are different. Autonomous agents can be detected through their behavioral patterns (they tend to be repetitive and predictable once you understand their decision logic). AI-assisted human operators retain human creativity and adaptability while gaining machine speed during execution.\n\nWe’re watching the offensive security landscape bifurcate. On one branch, fully autonomous agents like JADEPUFFER that can operate without human oversight. On the other, augmented operators like UNC-PRNT who use AI to amplify their individual capability by orders of magnitude.\n\nBoth branches are growing. And neither one is waiting for the defense industry to figure out its response.\n\nIf you’re building defensive agent workflows to monitor for this kind of thing, the OpenClaw + Claude Code: 24/7 Persistent Agent Playbook walks through setting up persistent monitoring agents that can actually keep pace with automated attack chains. For organizing the research and IOC data that comes out of these incidents, the Obsidian + Claude Daily Ops System has templates specifically built for security research and CTF workflows.\n\nThe Black Terminal Compendium: 2026 Edition\n\nPaid field manual in the terminal / local workflow route. Built for less clicking, fewer cloud dependencies, and more…\n\nnumbpilled.gumroad.com\n\nOpenClaw + Obsidian: The Ultimate Persistent Operator Co-Working System for Agents\n\nPaid field manual in the AI agents / OpenClaw route. From prompt toy to working system: memory, routing, tools, and…\n\nnumbpilled.gumroad.com", "url": "https://wpnews.pro/news/an-ai-agent-swarm-hit-440-papercut-servers-in-26-seconds-per-target-the-sector-a", "canonical_source": "https://dev.to/numbpill3d/an-ai-agent-swarm-hit-440-papercut-servers-in-26-seconds-per-target-the-education-sector-didnt-28nd", "published_at": "2026-09-23 22:38:22+00:00", "updated_at": "2026-09-23 22:58:51.543654+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "large-language-models", "ai-tools"], "entities": ["Huntress", "GreyNoise", "PaperCut", "OpenAI Codex", "DeepSeek", "CISA", "National Crime Agency", "UNC-PRNT"], "alternates": {"html": "https://wpnews.pro/news/an-ai-agent-swarm-hit-440-papercut-servers-in-26-seconds-per-target-the-sector-a", "markdown": "https://wpnews.pro/news/an-ai-agent-swarm-hit-440-papercut-servers-in-26-seconds-per-target-the-sector-a.md", "text": "https://wpnews.pro/news/an-ai-agent-swarm-hit-440-papercut-servers-in-26-seconds-per-target-the-sector-a.txt", "jsonld": "https://wpnews.pro/news/an-ai-agent-swarm-hit-440-papercut-servers-in-26-seconds-per-target-the-sector-a.jsonld"}}