The operation stands out less for any single novel flaw and more for how automation was used to scale reconnaissance, vulnerability discovery, and exploitation across a large number of targets. Rather than manually probing each victim, the actor reportedly relied on fleets of AI agents to handle repetitive tasks and accelerate the attack lifecycle.

Key points from the reporting:

• Target: internet-exposed PaperCut NG/MF print management servers
• Method: exploitation of known PaperCut vulnerabilities at scale
• Scale: 395 organizations impacted worldwide
• Attribution: likely Russian-speaking threat actor
• Notable element: use of hundreds of AI agents to develop and conduct the campaign

For defenders, the familiar fundamentals still apply: inventory any PaperCut NG/MF instances reachable from the internet, confirm they are patched against known vulnerabilities, and restrict exposure where printing infrastructure does not need to be publicly accessible. Given the automated nature of this campaign, delays in patching and asset tracking are exactly the gaps such tooling is designed to find.

Source: BleepingComputer

Does your organization run PaperCut NG/MF, and if so, is it exposed to the internet or kept internal-only?