PaperCut: Researchers Expose Hacker’s AI Toolkit Revealing Second PaperCut RCE Attack Path

AI-Powered PaperCut Exploitation Campaign Uncovered, Revealing Second RCE Vulnerability

A recently exposed attacker toolkit has shed light on an advanced campaign exploiting PaperCut servers, leveraging AI-driven automation and uncovering a second remote code execution (RCE) vulnerability via its XML-RPC API. The operation extended beyond initial server compromise, enabling credential theft, internal network access, and persistent tunneling through SOCKS5 proxies.

Key Findings & Attack Infrastructure

Security researchers at Hunt.io discovered three open directories on the IP 45.142.193[.]132 (ports 8000, 18080, 18081), containing:

• Exploit scripts targeting PaperCut vulnerabilities
• AI agent instructions (in Russian and English) using OpenAI’s Codex with DeepSeek models
• Operational logs documenting automated testing, debugging, and retries
• Windows credential collectors (SECURITY/SYSTEM registry hives, machine-account secrets)
• Packaged victim environments (3.9 GB across 1,924 files, 97 subdirectories)

The toolkit revealed 45 active reverse SOCKS5 pivots and 46 distinct Active Directory domains in victim archives. Additionally, 2,165 logged Metasploit attempts yielded five confirmed interactive sessions, though these figures represent only a subset of the campaign’s impact.

Second RCE Vulnerability via XML-RPC API

The attacker’s workbench exposed a previously undisclosed RCE route through PaperCut’s /rpc/api/xmlrpc endpoint, bypassing the original Tapestry component exploit (CVE-2026-81578). The method relied on:

• Weak API controls (accepting the built-in admin password as a fallback token)
• Manipulation of user lookup settings via api.setConfigValue and api.lookUpUserNameByCardNo
• Self-deleting temporary files (erased after 30 seconds) to evade detection

Post-Exploitation Tactics

After gaining access, the toolkit:

• Collected Windows credentials (registry hives, service accounts)
• Established SOCKS5 proxies for internal network access
• Deployed Linux persistence via chisel tunnels and cron jobs
• Reset configuration changes to minimize forensic traces

Campaign Scope & Attribution

Earlier research by GreyNoise and Blackpoint Cyber linked the campaign to 440 compromised PaperCut instances across 395 organizations in 48 countries. While Hunt.io’s findings focus on the attacker’s methods rather than breach counts, the exposed infrastructure (including a secondary VPS at 45.158.196[.]75) suggests a highly automated, AI-assisted operation.

Indicators of Compromise (IOCs)

• 45.142.193[.]132 – Primary orchestration server
• 45.158.196[.]75 – Secondary build/execution VPS

The discovery underscores the evolving sophistication of cybercriminal tooling, blending AI automation with traditional exploitation techniques to maximize persistence and lateral movement.

Source: https://cyberpress.org/second-papercut-rce-exposed/

PaperCut Software cybersecurity rating report: https://www.rankiteo.com/company/papercut-software

"id": "PAP1792139408",
"linkid": "papercut-software",
"type": "Vulnerability",
"date": "1/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': '395 organizations',
                        'location': '48 countries',
                        'type': 'Organizations'}],
 'attack_vector': ['Remote Code Execution (RCE)', 'XML-RPC API Exploitation'],
 'data_breach': {'personally_identifiable_information': 'Potential '
                                                        '(machine-account '
                                                        'secrets)',
                 'sensitivity_of_data': 'High (registry hives, machine-account '
                                        'secrets)',
                 'type_of_data_compromised': ['Windows credentials',
                                              'Active Directory domains']},
 'description': 'A recently exposed attacker toolkit has shed light on an '
                'advanced campaign exploiting PaperCut servers, leveraging '
                'AI-driven automation and uncovering a second remote code '
                'execution (RCE) vulnerability via its XML-RPC API. The '
                'operation extended beyond initial server compromise, enabling '
                'credential theft, internal network access, and persistent '
                'tunneling through SOCKS5 proxies.',
 'impact': {'data_compromised': ['Windows credentials (SECURITY/SYSTEM '
                                 'registry hives, machine-account secrets)',
                                 'Active Directory domains'],
            'identity_theft_risk': 'High (due to credential theft)',
            'operational_impact': ['Internal network access',
                                   'Persistent tunneling via SOCKS5 proxies'],
            'systems_affected': ['PaperCut servers']},
 'initial_access_broker': {'backdoors_established': ['SOCKS5 proxies',
                                                     'Chisel tunnels'],
                           'entry_point': ['PaperCut servers', 'XML-RPC API'],
                           'high_value_targets': ['Active Directory domains']},
 'lessons_learned': 'The discovery underscores the evolving sophistication of '
                    'cybercriminal tooling, blending AI automation with '
                    'traditional exploitation techniques to maximize '
                    'persistence and lateral movement.',
 'post_incident_analysis': {'root_causes': ["Weak API controls in PaperCut's "
                                            'XML-RPC endpoint',
                                            'Use of built-in admin password as '
                                            'fallback token']},
 'references': [{'source': 'Hunt.io'},
                {'source': 'GreyNoise'},
                {'source': 'Blackpoint Cyber'}],
 'response': {'third_party_assistance': ['Hunt.io',
                                         'GreyNoise',
                                         'Blackpoint Cyber']},
 'title': 'AI-Powered PaperCut Exploitation Campaign Uncovered, Revealing '
          'Second RCE Vulnerability',
 'type': 'Exploitation Campaign',
 'vulnerability_exploited': ['CVE-2026-81578',
                             'Undisclosed RCE via /rpc/api/xmlrpc endpoint']}