The Attack Timeline

The attack began on August 31, with the threat actor using AI to develop and refine exploits for two CVEs.

Exploits and Techniques

The attackers used a combination of OpenAI’s Codex and DeepSeek models, along with commodity tools, to launch the campaign.

Impact

The operation compromised at least 440 PaperCut instances, affecting 395 distinct organizations across 48 countries, with the education sector being the most targeted.

Defense Challenges

The attackers' rapid attack left defenders with very tight response margins, with the adversary achieving RCE in under four hours and full domain administrator access in seven minutes.

Attack Techniques

The attackers employed various techniques to gain access and maintain control, including:

• Dumping LSASS memory and registry secrets from domain-joined PaperCut servers.
• Using the “noPac” attack against vulnerable environments.
• Directly adding a newly created account to Domain Admins when PaperCut ran on a domain controller or under a domain administrator service account.

Toolset

The attacker's toolkit included Ligolo-ng, Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, and custom Rust credential-collection utilities.

Recommendations

System administrators are advised to apply PaperCut's emergency security updates and follow the vendor's recommendations to mitigate the risk of such attacks.