PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking actor weaponized recently disclosed PaperCut NG/MF flaws (CVE-2026-81578 and CVE-2026-82078), using AI agents (OpenAI Codex, DeepSeek), automation frameworks (Hindsight, AionUi), and offensive tools (Mimikatz, SharpHound, Certipy, Rubeus, Impacket) to compromise at least 440 PaperCut instances across 395 organizations in 48 countries; post-exploitation included credential harvesting, AD collection, and gaining domain admin in 12 organizations while the attacker’s ultimate goal remains unconfirmed.