PaperCut exploitation with AI agents: what should defenders change now?

TL;DR: A likely Russian-speaking actor used AI agents, public offensive tools, and an identified API key to develop and run PaperCut exploit chains that reached at least 440 instances across 395 victim organisations in 48 countries, with some compromises moving from initial access to domain admin in minutes, according to GreyNoise. Fast automation now compresses exploitation, credential harvesting, and privilege escalation into a single operational window that conventional patch-only thinking does not close.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF”.

Key questions

Q: What breaks when a vulnerable application can reach directory credentials?

A: The breach stops being an application-only problem.

Q: Why do high-privilege self-hosted applications create so much follow-on risk?

A: They collapse containment.

Q: How can security teams detect credential theft attacks?

A: Security teams detect credential theft attacks by watching for stolen secrets being used from new devices, locations or applications.

Practitioner guidance

• Harden internet-facing application tiers first Prioritise applications that can reach directory services, local admin contexts, or privileged service accounts, because those systems convert a web RCE into identity compromise.
• Remove standing privilege from high-trust service paths Audit service accounts, local admin rights, and domain-joined workloads for permissions that let one compromised host reach domain secrets or domain controller functions.
• Instrument for credential harvesting behaviour Look for LSASS access, registry hive dumping, DCSync activity, and base64-encoded hive staging in telemetry.

Bottom line: This campaign shows that AI-assisted attackers can turn a single exposed application into a rapid credential theft and privilege escalation event.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →