A vast network of AI agents orchestrated a global attack on the PaperCut software, compromising hundreds of organizations around the world in record time. This offensive, unprecedented in speed and complexity, illustrates the new capabilities of cybercriminals to exploit software vulnerabilities on a large scale.
Key takeaways
- 395 organizations in 48 countries were affected by a global campaign exploiting vulnerabilities in PaperCut.
- AI agents enabled rapid progression, with some companies compromised in just 26 seconds.
- Education is the most affected sector, with France ranking third among the affected countries.
Imagine you run a company using PaperCut to manage your printing and scanning. Overnight, you discover that your system has been infiltrated, your data compromised, and you are among the hundreds of organizations victimized by a coordinated attack. This is the reality many companies have faced in recent weeks.
The timeline of the attack: formidable efficiency
It all began at the end of August, when two vulnerabilities, CVE-2026-81578 and CVE-2026-82078, were revealed. Exploited by a Russian-speaking cybercriminal, they targeted PaperCut NG and MF. In no time, the attacker set up a lab to test their exploits, successfully executing remote code and retrieving critical credentials.
GreyNoise reported that the attack spread at lightning speed. In just four hours, the first victim was already compromised. The attack then took on a global dimension, affecting at least 11 companies in less than 30 seconds.
AI agents at the heart of the operation
The attack was distinguished by the intensive use of AI agents, orchestrated via the Codex environment and powered by the DeepSeek model. These agents automated many tasks, reducing the need for human intervention. Thanks to them, the attacker was able to chain actions with remarkable speed.
In some cases, such as in a high school in the United States, only seven minutes were needed to move from initial access to domain administrator rights. However, even though the agents played a key role, the human operator remained essential to define strategies and adjust actions based on the results obtained.
The global impact: unequal sectors and countries
Among the 395 affected organizations, the education sector was particularly impacted, representing nearly half of the victims. France ranks third among the most affected countries, with 31 compromised instances.
The attackers also managed to access sensitive information, such as Windows or Active Directory credentials and secrets, in many cases. Although the attack was largely automated, it left significant traces in the systems of the targeted companies.
The vulnerability of systems to AI in cyberattacks
This type of attack highlights the growing vulnerability of systems to the use of artificial intelligence in cyberattacks. As companies digitize, cybercriminals increasingly exploit advanced technologies to bypass traditional security measures.
The ability to automate attacks with AI, as demonstrated by this campaign against PaperCut, poses a major challenge for companies in all sectors. Adopting robust and responsive cybersecurity strategies becomes an imperative necessity to counter these increasingly sophisticated threats.
FAQ
What is PaperCut and why is it a target?
PaperCut is software used by many companies to manage printing, copying, and scanning functions. Cybercriminals target this type of software because it is often installed on servers with high privileges, allowing rapid progression in compromised networks.
How were AI agents used in the attack?
AI agents were deployed to automate tasks, from development and testing to exploiting vulnerabilities. This significantly reduced the time needed to carry out the attack.
Can we prevent such attacks in the future?
To reduce risks, companies must quickly apply security patches as soon as they are available and strengthen their systems with advanced cybersecurity solutions capable of detecting and countering automated threats.
Which sectors were most affected by this attack?
The education sector was particularly vulnerable, representing nearly half of the organizations affected by this global campaign.