Russian-speaking actor uses hundreds of AI agents to exploit PaperCut across 48 countries

Blackpoint Cyber and GreyNoise Intelligence reported a Russian-speaking actor operating from 45.142.193[.]132 who used hundreds of AI agents powered by OpenAI Codex and DeepSeek models to exploit PaperCut CVE-2026-81578 and CVE-2026-82078. Vulnerability research began on 31 August 2026 and remote code execution against the first victim was achieved in under four hours, with 11 organisations compromised within 26 seconds of campaign launch and one high school taken from initial access to domain admin in seven minutes. In total 440+ PaperCut MF/NG instances across 395 organisations in 48 countries were compromised, with education targets in Australia, the US, UK, France, Spain, Canada, Belgium, Portugal, Germany and Switzerland. Post-exploitation tooling included Mimikatz, SharpHound, Certipy, Rubeus and Impacket; domain administrator was obtained at 12 organisations.