Hundreds of AI Agents Compromise 395 Organizations Through PaperCut

GreyNoise documented a global cyberattack in which a likely Russian-speaking threat actor used hundreds of AI agents to develop, test, and execute attacks against vulnerable PaperCut NG/MF servers.

The operation used OpenAI's Codex agent harness with a DeepSeek model, alongside conventional offensive-security tools, to automate exploit development and large-scale victim compromise.

After developing and validating exploitation against a self-hosted lab environment, the attacker deployed hundreds of AI agents against internet-accessible PaperCut systems.

GreyNoise identified at least 440 compromised PaperCut instances belonging to 395 organizations across 48 countries. Education was the most heavily affected sector.

The campaign progressed beyond initial exploitation into credential harvesting, Active Directory compromise, Domain Admin access, DCSync, and theft of domain credential data.

On August 31, 2026, GreyNoise observed a likely Russian-speaking malicious actor using AI to develop and operationalize attacks targeting PaperCut NG/MF.

The actor created a self-hosted test environment containing vulnerable PaperCut software and Active Directory infrastructure and used AI-assisted workflows to build and validate remote-code-execution and credential-harvesting techniques.

In parallel, the attacker generated target lists of publicly reachable PaperCut systems.

After validating the attack chain, the adversary deployed hundreds of AI agents to attack vulnerable systems across the internet.

The agents used OpenAI’s Codex agent harness with a DeepSeek model and were supplemented with publicly available offensive-security tools.

GreyNoise identified 440 compromised PaperCut instances across 395 organizations in 48 countries.

Following initial access, the campaign harvested credentials and attempted to escalate into Active Directory environments.

Where compromised PaperCut systems were domain members, the attacker harvested LSASS memory and registry secrets to recover privileged credentials and perform pass-the-hash activity.

Other victims were attacked using known Active Directory privilege-escalation techniques.

Where PaperCut was installed on a domain controller or executed using highly privileged credentials, attackers were able to obtain Domain Admin access.

GreyNoise confirmed Domain Admin compromise at 12 organizations.

Once Domain Admin privileges were obtained, the attacker performed DCSync activity to obtain additional domain credential material.

PaperCut NG/MF / Windows Servers / Microsoft Active Directory / Domain Controllers / LSASS / Registry Secrets / Enterprise Credentials

Agentic AI Exploitation / Remote Code Execution / Credential Harvesting / Active Directory Compromise

GreyNoise identified at least 395 compromised organizations operating 440 affected PaperCut instances across 48 countries.

Education was the most heavily affected sector, with additional victims across commercial services, hospitality, IT and MSP organizations, nonprofits, manufacturing, energy, government, healthcare, legal, and financial services.

Credential harvesting occurred across hundreds of affected systems, and GreyNoise confirmed Domain Admin compromise at 12 organizations.

Successful Active Directory compromise created the potential for organization-wide credential exposure, lateral movement, persistence, data theft, and follow-on ransomware or extortion operations.

The speed of the operation is particularly significant. GreyNoise reported that once the full campaign was launched, at least 11 organizations were compromised within 26 seconds.

In one U.S. high-school environment, attackers reportedly progressed from initial access to Domain Admin in approximately seven minutes.

At publication, GreyNoise had not established the attacker’s ultimate monetization objective, so ransomware or extortion should not be attributed to this campaign without additional evidence.