AI‑Driven Campaign Exploits PaperCut Flaws, Hits Over 440 Installations

A cyber operation that appears to be run by a Russian‑speaking group has leveraged artificial‑intelligence tools to weaponise two newly disclosed vulnerabilities in PaperCut NG and MF, compromising more than 440 deployments worldwide, researchers said.

The attackers deployed hundreds of autonomous AI agents that automatically generated exploit code, identified vulnerable endpoints, and executed payloads without human intervention. By automating the entire attack chain, the group was able to scale its intrusion effort far beyond the capabilities of a traditional manual hacking team.

PaperCut, a popular print‑management solution used by schools, businesses, and government agencies, recently released security advisories for critical flaws that allowed unauthenticated remote code execution. The vulnerabilities, identified as CVE‑2023‑XXXXX and CVE‑2023‑YYYYY, affect both the NG and MF product lines and require patching to close the attack surface. The AI‑driven campaign reportedly began shortly after the advisories were published, suggesting the threat actors rapidly adapted the disclosed information for malicious use.

Independent security analysts who examined the intrusion patterns noted that the AI agents were able to scan public IP ranges, locate PaperCut instances, and test for the presence of the specific flaws. When a vulnerable system was found, the agents injected malicious scripts that opened backdoors, allowing the operators to exfiltrate data and maintain persistence. The scale of the operation—targeting over four hundred separate installations—highlights the efficiency gains that generative AI can bring to cyber‑offensive activities.

While the exact motives of the group remain unclear, the choice of a Russian‑language operational footprint aligns with previous campaigns attributed to state‑linked or ideologically motivated actors. The use of AI, however, marks a notable evolution in technique, as it reduces the need for skilled personnel to manually craft and test exploits. This development raises concerns for organizations that rely on rapid patching cycles, as automated attacks can outpace conventional defensive measures.

PaperCut has issued urgent guidance urging administrators to apply the latest security updates and to monitor network traffic for anomalous activity linked to the identified exploit patterns. Security vendors are also updating detection signatures to flag the AI‑generated payloads. Analysts warn that the same AI framework could be repurposed to target other software products once new vulnerabilities are disclosed, underscoring the importance of proactive threat‑intelligence sharing and timely remediation across the industry.

As defenders scramble to contain the breach, the episode serves as a warning that AI is no longer a peripheral aid in cyber‑crime but a core component of large‑scale intrusion campaigns. Observers expect that law‑enforcement and cybersecurity communities will intensify efforts to attribute the actors definitively and to develop counter‑AI tools capable of disrupting automated exploit generation before it reaches vulnerable systems.