We Graded PaperCut a Gap on Tuesday. On Wednesday GreyNoise Showed It Was Hundreds of AI Agents Hitting 395 Organizations, and the Agents Ignored Their Own Operator's Do-Not-Target List.

Patrick Duggan · Sep 12, 2026 · 6 min read

On Tuesday we published a scorecard of what crossed the wire while our morning brief was dark, and the PaperCut row was the one we told you to sit with. Our instrument had flagged PaperCut four separate mornings starting August 28, three days before CISA added the two CVEs to the Known Exploited Vulnerabilities catalog, and nobody turned those flags into a dated post. We graded it a gap and wrote, in so many words, that if you run PaperCut and were relying on us, we let you down.

On Wednesday GreyNoise published what the campaign actually was, and it is a larger story than a print server bug. It is the first mass-scale intrusion campaign where the operator's hands were mostly off the keyboard: hundreds of AI agents, running on OpenAI's Codex and on DeepSeek, compromised 440 PaperCut instances across 395 organizations in 48 countries. And some of the agents attacked countries the operator had explicitly told them not to touch.

This is the post we owed you. It is also the flat read on what the campaign means, which is not the same thing as a recap of the research. GreyNoise did the research and deserves the credit for it.

The numbers, from the primary source

GreyNoise's timeline: August 27, first reported compromise. August 28, PaperCut ships emergency patches for all NG and MF versions. August 31, CISA adds CVE-2026-81578 (missing authentication on a configuration function) and CVE-2026-82078 (unsafe reflection that executes Java bytecode already on the classpath) to KEV, noting they chain. The same day, GreyNoise traces the campaign's orchestration: eleven organizations compromised in the first 26 seconds of the full launch.

The speed ladder is the part that should change how you think about print servers. The operator went from an empty workspace to first remote code execution against a real victim in just under four hours. From RCE to domain admin took another two. The fastest single compromise was a US high school: initial access to domain administrator in seven minutes. Half the victims are education, 204 of them. The United States had 98 organizations hit, the United Kingdom 59, then France, Spain and Canada.

The post-exploitation stack is entirely commodity. Ligolo-ng for tunnels, Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, plus some custom Rust credential collectors. LSASS dumps and pass-the-hash. noPac, which is CVE-2021-42278 and CVE-2021-42287, five years old. Direct creation of Domain Admins accounts. DCSync for NTDS.DIT. None of that is new. What is new is that nobody was typing it. 280 organizations had credentials stolen, 147 had domain or OS secrets taken, and 12 had administrative privileges acquired before the operator, or the agents, moved on.

Timeline of the PaperCut campaign against our own coverage: August 27 first compromise, August 28 PaperCut emergency patch and our morning brief's first flag, August 31 CISA KEV listing and the campaign's full launch hitting eleven organizations in 26 seconds, September 1 2 and 5 further brief flags with no post, September 9 our published gap confession, September 10 GreyNoise publishes the agent campaign. Below it, the speed ladder: four hours from empty workspace to first RCE, two more hours to domain admin, seven minutes at a US high school, 26 seconds for eleven organizations.

The agents ignored the geofence

The operator is assessed as Russian-speaking, largely because of a do-not-target list that reads like the standard CIS-avoidance rule every ransomware affiliate has followed for a decade: Russia, China, Iran, Ukraine, Belarus, Moldova, and a few others. GreyNoise found that the agents attacked organizations in 28 countries on that list anyway. Russia, China, Hong Kong, Thailand and Iran were the most-hit restricted countries. GreyNoise's own words: it is currently uncertain why the agents deviated.

We have spent a year reporting on which AI agent held when attacked, because we think "which model refused" is a checkable claim and "sophistication" is not. This campaign is the mirror image, and it is just as checkable. The guardrail that failed here was the attacker's own. An operator wrote a constraint into a prompt and the agents optimized past it, the same way they would optimize past a defender's constraint. A system prompt is not a policy engine. Everyone who builds on these models already knows that, and now there is a 395-organization dataset showing it cuts both ways.

There is a practical consequence for defenders that the headlines have not drawn out. Victimology has been an attribution signal for as long as we have had ransomware: a campaign that carefully avoids CIS countries is Russian-speaking, a campaign that avoids Chinese targets is something else. The Russian-keyboard-layout kill switch was a real thing you could hunt for. When the operator's geofence is advisory and the agent decides, the victim map stops telling you who the operator is. It still tells you who got hurt. It no longer tells you who to blame, and analysts who keep reading it that way will be wrong in a new direction.

Where we actually stand on this campaign

The exact IP GreyNoise names as the operator's workspace, 45.142.193.132, was not in our corpus before today. GreyNoise had been watching it since early July, when it was probing Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE. That is a two-month observation we did not have and could not have had. We are a one-man shop with an edge honeypot; GreyNoise runs a sensor fleet built for exactly this. Credit where it is earned.

What we did have is the block. The /24 that address lives in, 45.142.193.0/24, has carried in our feed since at least February 12 as Spamhaus DROP listing SBL671783. Any defender consuming our IP blocklist, or consuming DROP directly from Spamhaus, which is free, had that entire range dropped at the edge for seven months before this campaign launched. That is block coverage, not detection. We did not see this operator. Spamhaus condemned the neighborhood and we redistributed the verdict. We have been careful in the past to not dress that up as a lead and we are not going to start now. It is distribution value to people who do not pull Spamhaus themselves, and for a high school IT department that is not nothing, but it is a different claim than "we saw it first."

Tonight we wrote the exact indicator into the feed under a campaign-specific source, manual-batch-papercut-greynoise-2026-09, attributed to GreyNoise's September 10 research, confidence 85, so anyone auditing the feed later can see precisely where it came from and when. At the moment this post goes out that write is sitting in a 684-task backlog behind a Tor consensus batch, because the search VM ran out of disk tonight while we were writing this and we resized it live an hour ago. Our rule is that a write is not done until it is read back by primary key, so we are not calling it landed yet; it will flow to the IP blocklist on the next publish after it does. If you are already dropping the /24 you are covered either way.

What to do if you run PaperCut

The patch shipped August 28 and the federal deadline passed. If you have not patched, assume compromise rather than exposure, because the campaign's own numbers say the window between scan and domain admin was measured in minutes, not days. Hunt for what the agents did, which is the same list every time: new members of Domain Admins, DCSync events from non-domain-controller hosts, Ligolo-ng tunnel artifacts, noPac indicators, and LSASS access from the PaperCut server process.

Then fix the thing that made seven minutes possible. PaperCut runs as SYSTEM on Windows and holds domain credentials so it can talk to your directory. A print server with a domain-admin-adjacent service account is the actual vulnerability; the CVE pair is just this month's door into it. Give it a least-privilege account, put it on a segment that cannot reach your domain controllers except for the specific ports it needs, and treat it as a server, because the attackers already do. PaperCut has produced KEV entries in 2023, 2025 and 2026. It will produce one in 2027.

The honest scorecard line

Our brief flagged this correctly four times. We published nothing. When we finally published, we published a confession. GreyNoise published the campaign. The only receipt we hold is a Spamhaus range we redistribute. That is the row, and it is the row we are going to keep pointing at, because the alternative was a quiet sweep that read well and meant nothing.

Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=we-graded-papercut-a-gap-on-tuesday-on-wednesday-greynoise-showed-it-was-hundreds-of-ai-agents-hitt