<![CDATA[PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances]]>A suspected Russian-speaking threat actor has been observed leveraging artificial intelligence to develop exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF, resulting in the compromise of 440+ exposed instances.

Independent research from Blackpoint Cyber and GreyNoise attributes the campaign to the IP address 45.142.193[.]132. According to the reports, the attacker used hundreds of AI agents as part of the exploitation effort, which is notable for the scale and automation involved rather than any novel vulnerability class.

Key facts from the reporting:

  • Targeted product: PaperCut NG/MF
  • Compromised instances: 440+
  • Attributed source IP: 45.142.193[.]132
  • Attributed actor: suspected Russian-speaking cyber actor
  • Tooling: hundreds of AI agents used to devise exploits for the two flaws

The two PaperCut vulnerabilities referenced were recently disclosed and are actively being exploited in the wild. Organizations running internet-exposed PaperCut NG/MF servers should treat this as an active threat and prioritize patching and exposure reduction.

Recommended actions:

  • Apply the latest PaperCut security updates as soon as possible
  • Audit internet-facing PaperCut NG/MF instances and remove unnecessary exposure
  • Monitor logs and network traffic for activity involving 45.142.193[.]132
  • Review authentication and application logs for signs of exploitation or post-compromise access

Source: The Hacker News

Has your organization already patched its PaperCut NG/MF instances, or are any still exposed while you work through remediation?

]]>https://xploitlk.com/topic/317/papercut-attacker-uses-hundreds-of-ai-agents-to-compromise-440-instancesRSS for NodeTue, 27 Oct 2026 12:19:38 GMTSun, 13 Sep 2026 04:30:20 GMT60