AI‑driven campaign hijacks PaperCut servers, compromising nearly 400 organizations

A coordinated cyber operation that leveraged artificial‑intelligence tools to locate and exploit flaws in PaperCut NG/MF print‑management software has breached the networks of roughly 395 entities worldwide, according to security researchers who first reported the activity.

The attackers, believed to be Russian‑speaking based on code artifacts and command‑and‑control infrastructure, deployed hundreds of AI‑powered agents. These agents automated the discovery of vulnerable PaperCut installations, generated exploit code, and launched attacks without direct human intervention, illustrating a shift toward more autonomous threat actors.

PaperCut NG/MF is widely deployed in corporate, educational and government environments to monitor and control printing resources. The software’s popularity makes it an attractive target, and the vulnerabilities exploited were known to the vendor but had not been patched on many systems at the time of the campaign. By compromising the servers, the threat actors could potentially intercept print jobs, harvest credentials, or use the foothold for further lateral movement within the victim networks.

The scale of the intrusion—affecting close to four hundred organizations—highlights the efficiency gains that AI can provide to malicious actors. Researchers observed that the AI agents were capable of scanning large IP ranges, testing for specific version signatures, and adapting the exploit payloads in real time, reducing the need for manual reconnaissance.

Following the disclosure, PaperCut released security updates to address the underlying weaknesses and issued advisories urging administrators to apply patches, enforce strong authentication, and restrict network exposure of the management console. Cyber‑security teams are also advised to review logs for signs of unauthorized access and to monitor for any anomalous printing activity.

The incident underscores a broader trend where threat groups incorporate machine‑learning and automation into their toolkits, raising the bar for detection and response. As defenders grapple with increasingly sophisticated, self‑directing attacks, timely patch management and vigilant monitoring remain critical defenses against such AI‑enhanced campaigns.