DEV Community

Anoymask
Anoymask

Posted on Edited on

PaperCut Authentication Bypass and Dynamic Class Loading: Pre-authentication RCE Chain Actively Exploited

#security #threatintel

1. Overview

2. Executive Summary

GreyNoise confirmed a campaign where AI agent groups repeatedly refined unauthenticated RCE chains against PaperCut. They compromised 395 organizations and over 440 devices, stole credentials, obtained Domain Admin privileges, and executed DCSync to dump NTDS.DIT.

3. Attack Flow

PaperCut CVE-2026-81578 and CVE-2026-82078: AI Agents Breach 395 Organizations and Automate DCSync

  • AI agents enumerate public-facing PaperCut instances and repeatedly attempt to chain CVE-2026-81578 and CVE-2026-82078.
  • They achieve SYSTEM code execution via the pc-app.exe process and discover domains, users, and hosts.
  • They escalate to Domain Admin via LSASS, registry secrets, noPac, or high-privilege service accounts.
  • They maintain connections using tools like Ligolo-ng and deploy authentication and Active Directory tools.
  • They use DCSync to dump NTDS.DIT and exfiltrate the organization's domain credentials.

4. Attacker Position and Execution Location

  • Attackers reach internet-facing PaperCut servers without authentication, operating AI agents and attack tools.

5. Visibility for Victims and Administrators

Victims

  • Print service anomalies may not be obvious. After compromise, the activity manifests as new domain accounts, authentication anomalies, and widespread credential misuse.

Administrators

  • Key indicators include cmd or PowerShell spawned under pc-app.exe, pcp_*.txt files under custom/web, saved registry hives, Ligolo, DCSync, and modifications to Domain Admins.

6. Success and Failure Conditions

Success Conditions

  • Unpatched PaperCut servers are exposed to the internet.
  • The PaperCut host is domain-joined and has vulnerabilities such as unpatched noPac or high-privilege service accounts.
  • Network segmentation and monitoring to block credential access and DCSync are missing.

Failure Conditions / Risk Mitigation

  • Apply the latest PaperCut emergency patch and do not expose the management interface to the internet.
  • Restrict the PaperCut service account to minimum permissions and do not run it on a Domain Controller.
  • Enable LSASS protection, implement AD tiering, monitor DCSync rights, and apply the noPac fix.

7. What Happens Upon Success

  • SYSTEM code execution on the PaperCut server.
  • Theft of OS and domain secrets, LSASS memory, and registry hives.
  • Acquisition of Domain Admin privileges and compromise of all domain credentials via DCSync.

8. Observable Logs

Email

  • None.

Proxy / SWG / DNS

  • Outbound traffic from PaperCut to retrieve tools, communicating with IPs such as 45.142.193[.]132.

Endpoint / EDR

  • Child cmd or PowerShell processes of pc-app.exe, pcp_.txt, pc-.hiv and pc-*.b64 files, Ligolo, and custom Rust tools.

Identity / IdP

  • New accounts such as Administrator17, modifications to Domain Admins, and pass-the-hash activity.

SaaS / Cloud

  • Discovery platforms like Netlas may leave no logs in the target organization.

Network

  • Ligolo tunnels, DCSync traffic, and rapid SMB, Kerberos, or LDAP lateral movement.

9. Attack Success Criteria

  • Malware Execution or Successful Authentication Confirmed: GreyNoise confirmed compromise of at least 440 devices and RCE on PaperCut.
  • Information Theft or Session Compromise Confirmed: Credential theft confirmed in 280 organizations; OS or domain secrets obtained in 147 organizations.
  • Subsequent Compromise Confirmed: Administrative privileges obtained in 12 organizations, with DCSync and NTDS.DIT dumps confirmed across all Domain Admin paths.

10. Investigation Playbook

Starting Point

  • Begin an investigation when detecting vulnerability exploitation, abnormal authentication, IOCs, or behaviors described in this report related to target products or accounts.

Initial Verification

  • Check asset versions, configurations, exposure scope, event timestamps, source IPs, and target IDs.
  • Distinguish between the observation scope indicated by external sources and the evidence confirmed within your own organization.

Endpoint

  • Review process lineage, file creation, permission changes, persistence mechanisms, and credential access in chronological order.

Identity / Cloud

  • Check for authentication method changes, token usage, and cloud data access using the same user, source, and session.

Further Investigation

  • Expand the investigation scope from the initial compromise point to internal discovery, lateral movement, C2, archive creation, and data exfiltration.

Containment

  • Isolate or restrict public access to the target and apply the patched version. If a compromise is confirmed or suspected, revoke and rotate sessions, keys, passwords, and other related secrets.

Determination

  • Record as an attack attempt if only requests or IOC contacts are found. Record as the corresponding success stage if evidence of execution, authentication, or data access is found.

11. Defense and Detection Ideas

Single Events

  • Outbound traffic from PaperCut to retrieve tools, communicating with IPs such as 45.142.193[.]132.
  • Child cmd or PowerShell processes of pc-app.exe, pcp_.txt, pc-.hiv and pc-*.b64 files, Ligolo, and custom Rust tools.
  • New accounts such as Administrator17, modifications to Domain Admins, and pass-the-hash activity.
  • Discovery platforms like Netlas may leave no logs in the target organization.

Time-Series Correlation

  • Correlate short-term abnormal authentications, configuration changes, discovery activities, high-volume access, and outbound traffic originating from the same entity.

Threat Hunting

  • Hunt retroactively for processes, authentications, network traffic, and configuration changes that represent the same attack steps, without relying solely on the IOCs in this report.

Log Gaps

  • Verify target log activation, time synchronization, retention periods, and correlation keys across endpoints, cloud environments, and perimeter devices.

Priority Mitigations

  • Apply the latest PaperCut emergency patch and do not expose the management interface to the internet.
  • Restrict the PaperCut service account to minimum permissions and do not run it on a Domain Controller.
  • Enable LSASS protection, implement AD tiering, monitor DCSync rights, and apply the noPac fix.

12. Facts / Inference / Hypothesis

Facts

  • Chaining the authentication bypass in CVE-2026-81578 and the dynamic class loading in CVE-2026-82078 allows code execution with SYSTEM privileges on PaperCut.
  • GreyNoise confirmed compromises starting August 31, 2026, across at least 440 devices, 395 organizations, and 48 countries. Credentials were obtained in 280 organizations, OS or domain secrets in 147 organizations, and administrator privileges in 12 organizations.
  • Attackers achieved RCE on victim systems in less than 4 hours from an empty working environment, reached the first Domain Admin in about 2 hours, and after full deployment, breached 11 organizations in 26 seconds. At a high school in the US, Domain Admins were reached 7 minutes after initial access.
  • Domain Admin access was achieved via three paths: obtaining hashes from LSASS or registry secrets for pass-the-hash, using unpatched noPac, or adding a new account to Domain Admins in environments where PaperCut runs on a Domain Controller or uses a Domain Admin service account.
  • DCSync was executed across all paths to create a complete NTDS.DIT dump containing organization credentials.
  • Ligolo-ng, Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, and a custom Rust credential harvesting tool were used. AI agents iteratively modified target lists, exploits, and operational procedures.

Inference

  • Investigation and detection methods for each environment were analyzed based on attack behaviors confirmed in public information. Actual evidence obtained depends on log settings and retention periods.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: high): Chains two vulnerabilities in public-facing PaperCut servers.
  • T1003.001 OS Credential Dumping: LSASS Memory (Confidence: high): Obtains credentials from LSASS memory.
  • T1550.002 Use Alternate Authentication Material: Pass the Hash (Confidence: high): Connects to the Domain Controller using harvested hashes.
  • T1003.006 OS Credential Dumping: DCSync (Confidence: high): Retrieves NTDS.DIT via DCSync after obtaining Domain Admin privileges.
  • T1572 Protocol Tunneling (Confidence: high): Relays internal connections using Ligolo-ng.

14. Unknowns and Further Investigation

  • Whether the ultimate objective is selling access, data theft, or ransomware.
  • The total number of breaches exceeding public figures and the recovery status of each organization.

15. Impact on SOCs and Organizations

Organizations that exposed PaperCut must conduct retroactive investigations assuming a compromise occurred during the exposure period, even if they have already updated the software. If PaperCut was located on a Domain Controller, used a high-privilege service account, or ran in an unpatched noPac environment, attackers could escalate to Domain Admin within minutes. SOCs must review pc-app.exe child processes, LSASS and registry hives, Domain Admin modifications, and DCSync events as a single chronological timeline.

16. Summary by Role

  • SOC: Retroactively search for pc-app.exe child processes, pcp_*.txt files, saved hives, Ligolo, Domain Admin modifications, and DCSync activity.
  • Administrators: Apply the latest emergency patch and stop external exposure. Restrict service accounts to minimum permissions, remove them from DCs, and fix unpatched noPac vulnerabilities.
  • Users: This attack does not require user interaction. Contact administrators if you experience printing failures or suspicious authentication notifications.

Top comments (0)