On 31 August somebody pointed hundreds of AI agents at the internet's print servers. Twenty six seconds later, eleven organizations were compromised.
That is the central finding of a report published by GreyNoise, which watched the campaign run against PaperCut NG/MF, the print management software that schools, councils and companies use to track and charge for printing and scanning. GreyNoise counted at least 440 compromised PaperCut instances belonging to 395 identifiable victim organizations across 48 countries, and says there were more victims it could not tie to a named organization.
A person still made the decisions. The agents did the work.
Four hours from an empty workspace
GreyNoise says it has tracked the address 45[.]142[.]193[.]132 since early July 2026, when it started hitting internet-facing gear from Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE. On 31 August the same address turned to PaperCut and two flaws in it, CVE-2026-81578 and CVE-2026-82078, which we covered when the first exploitation appeared and which CISA added to its known-exploited catalog.
The actor, whom GreyNoise describes as likely Russian-speaking, began by building a lab containing vulnerable PaperCut software and an Active Directory server, and attacked it until the exploits worked. In a parallel workflow it assembled target lists through the internet scanning service Netlas.io using an identified API key. Then it launched, with hundreds of agents running on OpenAI's Codex harness and a DeepSeek model. GreyNoise is specific that the agents were not using OpenAI models, and that publicly available offensive security tools did most of the hands-on work.
The timings are the part worth reading twice. From an empty workspace to code execution against a real victim took just under four hours. The first domain admin followed two hours after that. Against a high school in the United States, the actor went from initial access to full domain administrator in seven minutes.
Why a print server hands over a domain
PaperCut NG and MF are self-hosted Java web applications. On Windows they run with SYSTEM privileges by default, and they are usually domain-joined and integrated with Active Directory, which puts them in exactly the position an attacker wants. Where the agents reached domain admin, GreyNoise saw three routes: dumping LSASS memory and registry secrets to pass the hash to a domain controller, a noPac attack against victims who never patched CVE-2021-42278 and CVE-2021-42287, or simply adding a new account to Domain Admins when PaperCut was already running on the controller. Every path ended in a DCSync and a full NTDS.dit dump of the organization's credentials.
It did not work everywhere. Of 440 compromised instances, GreyNoise recorded credential harvesting at 280, operating system or domain secrets at 147, and domain admin at just 12. Education absorbed 204 of the victims, most likely a reflection of who buys PaperCut rather than of who was targeted. The United States led with 98 victims, then the United Kingdom with 59.
The agents ignored their own no-go list
The operator supplied a list of 28 countries to avoid, carried over from earlier campaigns, headed by Russia, China and Iran. The victim tables show hits in China, Kazakhstan, Pakistan, Brazil, South Africa, Namibia, Nigeria and Zimbabwe anyway. GreyNoise cannot say why the agents deviated, and offers it as a plain illustration of what happens when an autonomous workflow is not properly constrained. That cuts both ways: it is an operational risk for the attacker and an unpredictable one for everyone else. The same pattern of compressed intrusion timelines showed up when agents broke into a company in under ten hours earlier this month.
Patch PaperCut, then check the domain path
Update PaperCut NG and MF for CVE-2026-81578 and CVE-2026-82078, and treat any unpatched instance as compromised rather than exposed. Patch CVE-2021-42278 and CVE-2021-42287 if you have not, since attack path B depends on them. Hunt for the account name Administrator17, for registry hives staged at C:\Windows\Temp\pc-system.hiv and C:\Windows\Temp\pc-security.hiv with matching .b64 files, and for a Ligolo tunnel agent at C:\ProgramData\ligolo-agent.exe or C:\ProgramData\LegitSvc\legit-svc.exe. Tooling was pulled from 45[.]142[.]193[.]132 over hxxp on ports 8000 and 8089, with a second address, 45[.]158[.]196[.]75, used to execute the campaign.
One detail deserves more attention than the speed records. In at least one attempt, GreyNoise saw a Cloudflare web application firewall simply defeat the adversary. Agentic tooling changes how fast an intrusion moves, not what it needs to succeed, and a fleet of AI agents still ran into a patched host and a filtering layer and stopped.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.