Threat actors are actively exploiting two recently disclosed vulnerabilities in PaperCut NG/MF servers, using the access to execute commands, harvest credentials, conduct reconnaissance, and deploy Metasploit Meterpreter payloads.
Researchers Jens Pose and Ross Phillips observed attacks targeting PaperCut instances vulnerable to CVE-2026-81578 and CVE-2026-82078.
The activity follows PaperCut’s August 27 disclosure of active exploitation. CVE identifiers were assigned the next day, while CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31.
Hackers Exploit PaperCut NG/MF Flaws
The observed intrusion chain begins with exploitation of exposed PaperCut servers, enabling attackers to run operating-system commands through the affected application.
Researchers identified basic environment-discovery commands including uname, whoami, ver, and tasklist, suggesting operators were profiling compromised machines before expanding their access.
Attackers also attempted to create a privileged local account named Administrator17, a behavior that could provide persistence and administrative control even after the initial PaperCut vulnerability is remediated.
Inbound requests from 45[.]142[.]193[.]132 targeted files matching /custom/pcp_*.txt and /custom/web/pcp_*.txt.
These files appeared to contain command output and harvested host or user information, allowing attackers to retrieve collected data from compromised PaperCut systems.
The campaign involved several Windows credential-collection utilities: lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe. The tools were downloaded with certutil from an attacker-controlled server at 45[.]142[.]193[.]132.
Sandbox analysis showed lsa_collect.exe extracting registry keys needed to reconstruct the Windows BootKey. Access to the BootKey can help an attacker decrypt protected credential material associated with the Security Account Manager (SAM) database.
Researchers also observed attackers searching PaperCut configuration files for sensitive values. The command used findstr to identify entries containing terms such as password, secret, ldap, bind, and token.
These searches may expose service-account credentials, LDAP bind passwords, API tokens, and other secrets stored in PaperCut-related configuration files.
In addition to credential collection, attackers downloaded Java-based Metasploit Meterpreter components from 194[.]180[.]48[.]134. The infrastructure hosted a JarFileClassLoader.class payload under a path associated with Metasploit’s Meterpreter framework.
Meterpreter is commonly used for post-exploitation because it can provide interactive remote access, process and network discovery, credential theft support, file transfers, and pivoting opportunities.
Its presence indicates that attackers were likely seeking durable control of victim environments rather than conducting opportunistic scanning alone.
Mitigation
Defenders should review PaperCut server.log files for exploitation strings, including jdbc:derby:memory:pwn;create=true, VALUES CAST, and VALUES CAST(X'cafebabe. Administrators should also search PaperCut directories for unusually short five-character .class, .cmd, and .out files.
Security teams should investigate pc-app.exe spawning cmd.exe, PowerShell, or other interpreters, especially where command lines contain whoami, tasklist, ver, or uname -a. Endpoint telemetry should be checked for the credential tools and the account name Administrator17.
Organizations should immediately apply PaperCut’s recommended fixes, remove management interfaces from direct internet exposure, and hunt for the listed IP addresses, URLs, file hashes, and python-requests/2.32.5 user-agent activity.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
