AI-Orchestrated Exploitation Campaign Targeting PaperCut NG/MF Software

A sophisticated, highly automated cyber campaign is targeting PaperCut NG and MF print management software through a distributed fleet of hundreds of AI-driven agents. Attributed to a suspected Russian-speaking threat actor, the campaign utilizes artificial intelligence to autonomously generate and execute exploits against recently disclosed vulnerabilities. This orchestration enables unprecedented operational speed, facilitating large-scale reconnaissance and lateral movement that allows attackers to escalate privileges to Domain Admin in under five minutes. To date, the campaign has successfully compromised 440 servers across 48 countries, demonstrating a significant leap in automated, high-velocity exploitation capabilities.

• Incident Overview & Scale
  • Global impact confirmed across 48 distinct countries.
  • 440 individual servers identified as successfully compromised.
  • Threat actor suspected to be a Russian-speaking entity utilizing autonomous frameworks.
• Attack Mechanics & AI Orchestration
  • Deployment of hundreds of autonomous AI agents for vulnerability scanning and exploitation.
  • Real-time exploit generation leveraging AI logic to target specific software flaws.
  • Large-scale automated reconnaissance used to map target environments efficiently.
• Technical Impact & Escalation
  • Achievement of Domain Admin privileges in less than five minutes post-initial access.
  • Extremely rapid lateral movement facilitated by AI-driven automation.
  • Direct exploitation of vulnerabilities within PaperCut NG and MF print management environments.
• Indicators & Defensive Response
  • Primary Indicator of Compromise (IoC): IP 45.142.193.132.
  • Urgent requirement for patching PaperCut NG/MF software to mitigate known flaws.
  • Need for enhanced detection of high-velocity, automated privilege escalation patterns.
• Conclusion
  • Represents a critical paradigm shift toward autonomous, AI-orchestrated cyber operations.
  • Challenges traditional incident response windows due to extreme escalation velocity.