Attackers plant remote access tools on compromised PaperCut servers

PaperCut disclosed active, in-the-wild exploitation of two zero-day vulnerabilities in PaperCut NG/MF that allowed unauthenticated attackers to bypass authentication and execute arbitrary Java bytecode on Application Servers; attackers used this access to enumerate domain information and silently install remote access software (SimpleHelp and AnyDesk). PaperCut issued emergency patches (multiple rounds), advised restricting web access to trusted IPs, preserving forensic evidence, and rebuilding compromised servers; observed IOCs include a Windows service named "Remote Access Service" running SimpleService.exe from C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted and unexpected AnyDesk installations.