According to GreyNoise, an attacker wrote the exploit and then outsourced the intrusion to autonomous agents: four hours from the empty workspace to the first remote code execution.
GreyNoise describes a campaign where most of the intrusion work was delegated to autonomous agents. The attacker, who researchers believe to be Russian-speaking, first set up a private lab containing a vulnerable copy of the PaperCut NG/MF print management software and an Active Directory server, in order to develop exploits for two vulnerabilities referenced CVE-2026-81578 and CVE-2026-82078.
Once the tooling was ready, the agents took over. They were running on OpenAI's Codex harness associated with a DeepSeek model, supplemented by publicly available offensive tools. The toll put forward is at least 440 compromised PaperCut instances, spread over 395 organizations identified in 48 countries.
The timeline is the most striking point in the report: less than four hours separate the empty workspace from the first remote code execution in a real victim, and domain administrator rights fell two hours later. Credentials were recovered from 280 victims, system or domain secrets from 147, and administrator privileges obtained from 12 organizations. The education sector alone accounts for about half of the breaches.
Read the full article on the original source
Go to the source →