AI Papercut Attacker targeting New Zealand and Australia Organisations

A suspected Russian linked cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances has been observed scanning New Zealand and Australian IP addresses as part of its campaign.

According to independent reports from Blackpoint Cyber and GreyNoise, the activity is linked to “45.142.193[.]132” and “45.142.193[.]196” IP addresses that has been linked to unauthorized port scanning and brute-force attack attempts in recent weeks.

For New Zealand activity the IP addresses were observed scanning IP Sec, iDRAC, ldap/ldaps services as well as attempting Global Protect VPN logins.

It’s worth noting that some of the same IP addresses were also flagged by Arctic Wolf in connection with the exploitation activity last week.

It is not known if the aim of the campaign is by an initial access broker or a ransomware operator/affiliate.  Nor do we know the name of the Australian business where Domain Admin access was gained on the morning of the 1st of September.

The campaign attempts to exploit CVE-2026-81578 and CVE-2026-82078, a combination of an authentication bypass and remote code execution chain.

GreyNoise said it has been tracking the malicious use of the IP addresses since early July 2026 for probing internet-facing systems from several vendors, including Palo Alto GlobalProtect, Ubiquiti, Citrix, SonicWall, and Proxmox VE and other reports online for FortiWeb scanning from the IP address as well.

In 1 day and 8 hours the actor completed exploit development and testing, they built and attacked a lab environment that included the vulnerable PaperCut software and an Active Directory server as well as repeatedly refined a target list of victims. Pre AI this would have taken weeks.

Fortunately for us but unfortunately for the attacker they left an open HTTP directory on the host they were using which shed light on exactly how they were executing their campaign.

They were observed using netlas.io, an online scanner to help build their target list.  Netlas.io do not list which IP addresses they use to do their scanning so organisations cannot identify if they have been scanned nor block future scans.  You could register for a free account and check what information is held by netlas.io against your IP addresses though it is less featured than shodan.io.

Upon gaining remote code execution and credential harvesting within its self-hosted lab environment, the threat actor has been seen unleashing hundreds of AI Agents powered by AionUI, a free open-source desktop app that brings multiple command-line AI agents and models together, as well as publicly available offensive security tools (e.g., Mimikatz, SharpHound and Impacket).

In the end they compromised more than 440 instances of PaperCut hosted by 395 identified victim organizations in 48 countries, while avoiding victims in 28 listed countries including Russia and China.

Timeline

IOCs

IP Addresses – Unsurprisingly none of these with in the Malware Free network feeds

Search between 15th July 2026 and 8th September 2026.

45.142.193[.]132

45.142.193[.]196

194.180.48[.]134

Ports scanned

tcp: 389, 636, 4300, 4301, 4117, 4118, 9191, 9292, 9195

udp: 500, 4500, 623

About the Author

threatinfo

Administrator

Visit Website View All Posts