AI agents breached 395 organisations. A service account opened the domain.

On 10 September 2026, GreyNoise published an analysis of a campaign that compromised 440 PaperCut NG/MF servers across 395 organisations in 48 countries. Hundreds of AI agents did the exploitation. But the step that turned a print management server into a full domain takeover was not the agents. In several environments it was the service account the software was already running as.

That distinction matters, because only one of those two things is under your control this week.

What the researchers found

Two teams published on the same campaign. GreyNoise reconstructed the operation from the attacker's own exposed infrastructure. Blackpoint Cyber published a parallel teardown of the tooling and the post-exploitation activity it observed in customer environments.

The flaws are in PaperCut NG and MF, the print management software running on a server in a great many schools, universities and offices. CVE-2026-81578 allows unauthenticated manipulation of PaperCut configuration. CVE-2026-82078 turns unsafe connector behaviour into code execution. Chained, they take an attacker from an unauthenticated web request to arbitrary code execution as the PaperCut service, with no credential required.

PaperCut published an urgent security bulletin on 27 August 2026 with fixed releases and an instruction to keep the Application Server off the public internet. The campaign began four days later.

From an empty workspace, the operator reached remote code execution against a real victim in just under four hours, and Domain Admin two hours after that. Once the exploit was reliable, the pace changed entirely. GreyNoise records at least 11 organisations compromised in 26 seconds.

Anatomy of the path

netlas-scan        # exposed PaperCut servers, target list built via API
  → papercut-server   # CVE-2026-81578 config change, no authentication
  → code-execution    # CVE-2026-82078, runs as the PaperCut service
  → service-account   # LDAP bind, database and machine credentials
  → active-directory  # pass-the-hash, noPac, or simply Domain Admins
  → ntds.dit          # DCSync, every credential in the domain

Blackpoint describes the post-exploitation stage as administrator account creation, credential harvesting and Active Directory discovery, followed by a proxy for persistent access. The credentials taken at that stage were not user passwords. They were LDAP bind credentials, database credentials and machine accounts: the credentials the print server needs in order to do its job.

From there GreyNoise documents three routes onward. The first harvested LSASS process memory and registry secrets, then used pass-the-hash against the domain controller. The second used noPac, against environments still unpatched for CVE-2021-42278 and CVE-2021-42287. The third is the one worth reading twice.

Where PaperCut ran as a domain-admin service account, the adversary simply added its newly created account to Domain Admins.

All three routes ended in the same place: DCSync, and a dump of every credential hash in the domain.

The service account was the breakpoint

A print server is not a crown jewel. Nobody puts it on the asset register next to the finance database. But it needs to read your directory to know who is allowed to print, so it holds an LDAP bind credential. It needs to write usage records, so it holds a database credential. And it runs as a Windows service account that somebody, at some point, found easier to make a domain administrator than to scope properly.

That account is a non-human identity. It has no real owner, it never appears in an access review, it does not rotate, and its privilege was set once during an installation that may predate everyone on the team. The software around it was patched on a schedule. The account was not, because accounts are not something most organisations think of as patchable.

This is the same structural gap that produced the Salesloft Drift OAuth breach, where tokens issued to one integration reached data in hundreds of organisations. The credential type differs. The failure does not: a machine identity held standing access far beyond what its function required, and nobody was measuring that reach.

Look at those three numbers as a funnel. The vulnerability was worth the same everywhere: 440 servers fell to it. What varied between victims was what the compromised service could reach next. In 12 organisations, the answer was everything. Patching decided who got in. Privilege decided who lost the domain.

What the agents added, and where they went off script

GreyNoise attributes the exploitation to hundreds of AI agents running on an OpenAI Codex harness paired with a DeepSeek model, alongside standard offensive tooling: Mimikatz, BloodHound, Certipy, Rubeus, Impacket and NetExec. Target lists came from the Netlas.io scanning service through an API key the researchers recovered.

It is worth being precise about what the agents actually changed. They did not invent a new technique. Every step in the path above is ordinary Windows attack tradecraft that has been documented for years. What the agents supplied was throughput and patience: exploit development and testing compressed into hours, then parallel execution against thousands of targets with failure handling that a human operator would not sustain. Blackpoint observed the campaign sorting its 291 unsuccessful targets by the specific reason each one failed, rather than simply retrying them.

The agents also made a mistake no human operator would have made. The operator kept a list of 28 countries to avoid, carried over from earlier campaigns. The agents ignored it and hit organisations inside those jurisdictions anyway. GreyNoise calls this "Agents Gone Wild", and it is a useful corrective to the idea that agentic attacks are precise. They are fast and they are cheap. They are not careful.

One detail deserves more attention than it will get: one instance in the campaign was stopped by a Cloudflare web application firewall. Ordinary hardening still worked here.

What to check this week

1. Patch PaperCut and take it off the internet. Apply the fixed releases from the 27 August bulletin, then verify from outside your network that the Application Server is not reachable. PaperCut's own guidance is that it should not be publicly exposed at all.
2. Check what the PaperCut service account actually is. Open the service properties and look at the logon account. If it is a domain administrator, that is your finding for the week. Scope it down to what printing needs and nothing more.
3. Do the same for every other appliance-style server. Print, backup, monitoring, scanning, ticketing, asset management. Anything installed by a vendor wizard years ago is a candidate for the same over-privileged account.
4. Rotate the credentials that server held. Its LDAP bind account, its database credentials and its machine account password. If the box was exposed before you patched, treat all three as known to someone else.
5. Hunt for the post-exploitation signs. Blackpoint points at child processes spawned from pc-app.exe, in particular cmd.exe, powershell.exe and whoami.exe, along with changes to the user-lookup configuration and artefacts such as save_hives.exe.
6. Close the noPac gap. CVE-2021-42278 and CVE-2021-42287 are five years old and were still a working route to Domain Admin in this campaign. Confirm your domain controllers are patched.
7. Alert on new members of Domain Admins. The third route in this campaign was a group membership change. That is a single, cheap detection rule, and it would have fired within seconds.

The agents in this campaign were the reason 395 organisations were hit in days rather than months. The service account is the reason 12 of them lost the entire domain. Speed is the attacker's variable. Reach is yours. Elmoz maps what each machine identity in your environment can reach, before someone else measures it for you.