16 SEP 2026 — An attacker pointed hundreds of AI agents at print servers and compromised 440 of them across 395 organisations in 48 countries. In one burst, eleven organisations fell in 26 seconds.
PaperCut NG and MF are the print management software we have written about twice this month for separate reasons. The software and its flaws were already familiar. The new part is the method. GreyNoise describes an intrusion set built and driven by commercial AI models working from an empty workspace.
What the agents did
The operator, described as a Russian-speaking actor, used OpenAI's Codex as the harness and a DeepSeek model alongside it, together with publicly available offensive security tools. GreyNoise reconstructs the work backwards. The agents analysed the vendor patches, reproduced the code execution path in a local virtual lab, built multi-threaded scanning tools in Go, and refined their network probes against the errors they were getting back.
From an empty workspace to remote code execution against a real victim took just under four hours. The first domain administrator followed two hours after that.
The flaws exploited were CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution issue via unsafe reflection. On systems that had not patched a four-year-old Windows problem, the agents also used the noPac pair, CVE-2021-42278 and CVE-2021-42287, to escalate inside the domain.
The ratio that matters
Four hundred and forty compromised servers produced twelve organisations where the attacker reached domain administrator. That ratio is the most useful thing in the report.
Speed at the front of an intrusion is cheap. Scanning, exploiting a known flaw and landing on a box are the repetitive tasks an agent swarm does well. The 26-second burst was hundreds of workers running a pre-written exploit at once.
Turning that into control of a domain is a different kind of work, and it mostly did not happen. Where it did, it was fast. At one American high school, initial access became domain administrator in seven minutes; across the twelve organisations, times ranged from five minutes to 144. GreyNoise also counts 280 successful credential harvests and 147 extractions of operating system or domain secrets. Those sit between "a compromised print server" and "the domain is gone".
Who it hit
Education took 204 of the 395 victims, seven of them to domain administrator. The rest are spread across retail and professional services at 38, real estate and hospitality at 29, and IT, managed service providers and print resellers at 25, with 51 unclassified.
The United States accounted for 98 victims, the United Kingdom 59, France and Spain 31 each, and Canada 24.
Schools run print servers, which is the whole explanation. A university or a school district operates exactly this software at scale, often exposed so students can print from their own machines, and rarely with the staffing to patch it the week a fix lands.
The avoidance list is the attribution
The agents were instructed to skip 28 countries, among them Russia, China, Hong Kong, Belarus, Kazakhstan, Ukraine, Iran and Venezuela. The list also includes Thailand, Vietnam and Indonesia. That is a less familiar pattern for readers in this region, and it means the operator treated much of Southeast Asia as out of bounds.
An avoidance list is a choice a human makes before the automation starts. It is also the closest thing to evidence of origin in the report, alongside the infrastructure and a Netlas.io scanning key that GreyNoise attributes to the same operator. No confidence level is stated for the attribution, and nothing in the public reporting names a group.
What stopped it
GreyNoise records that a web application firewall stopped the adversary in at least one instance. Its conclusion is a modest one, and it is correct. Fundamental hardening still matters against AI-enabled threats. Nothing in this campaign defeated a control that was actually in place; it defeated the absence of one, faster than before.
For defenders, the practical takeaways are short. Patch the two PaperCut flaws. Check whether noPac still works in your domain, four years on. Hunt for the Rust credential dumpers and registry hive staging in Windows\Temp and ProgramData that the report names, and for an account called Administrator17.
What to watch
The first question is what the access was for. GreyNoise says it is unclear whether the operator intended to resell it or to run follow-on operations such as data theft or ransomware, and notes that previous PaperCut intrusions led to extortion. The answer arrives later than the intrusion, usually on someone else's timeline.
Then the ratio. If the next campaign turns many more than twelve of 440 into domain administrator, because agents improve at lateral movement rather than scanning, the economics change completely.
The models are the third question. Two commercial systems did this work. The disclosure worth waiting for is whether either provider detected the activity on their side, given that both have published policies about exactly this use.
View author profile → · Editorial policy
