GreyNoise has published research on a campaign against PaperCut NG and MF that it calls, with some justification, Agents Gone Wild.

A likely Russian-speaking operator used hundreds of AI agents — run through OpenAI's Codex as the harness, with a DeepSeek model, and a conventional offensive toolkit including Mimikatz, SharpHound, Certipy, Rubeus and Impacket — to compromise 440 PaperCut instances belonging to 395 identified organisations in 48 countries.

The flaws are not new to readers here. The agents exploited CVE-2026-81578, an authentication bypass, and CVE-2026-82078, an unsafe-reflection remote code execution bug — the same pair we covered when attackers first went after PaperCut's LDAP bind credentials.

What is new is the operator, and the part of the operation the operator did not control.

The numbers, and what each one counts

Three counts, three different units, and they will be blurred together:

  • 440 is PaperCut instances — servers.
  • 395 is organisations GreyNoise could identify behind them. Some own more than one server.
  • 48 is countries. The Register's breakdown of the same data puts the United States at 98 organisations and the UK at 59.

Deeper in, the numbers get more serious and much smaller. GreyNoise records credential harvesting on 280 instances, operating-system or domain secrets taken from 147, and full domain administrator reached in 12 organisations.

That last figure is the one that matters. A compromised print server is a foothold. Domain admin is the organisation.

How fast

The timings GreyNoise reconstructed are the point of the research:

  • Target lists were built with the internet-scanning service Netlas.io, using an identified API key.
  • One of the operator's addresses was first tracked attacking in early July 2026; the orchestrated campaign launched on 31 August.
  • From the operator's lab to the first remote code execution took under four hours, and a further two hours to reach domain admin.

Against real victims, the fastest escalation to domain admin took five minutes, at a US high school, and the slowest took 144 minutes. The Register, reporting GreyNoise's data, put the campaign's peak pace at 11 organisations in 26 seconds. There is no human in that loop. Nobody reads output at that speed; at best, an operator reads a summary of what the agents already did.

The list the agents did not finish reading

The operator gave the agents a list of 28 countries to leave alone, carried over from its previous campaigns. The agents hit organisations in six of them anyway: South Africa (9), Brazil (5), and one each in Namibia, Nigeria, Zimbabwe and Pakistan. That is 18 victims in countries the operator had explicitly told them to skip, in a campaign moving faster than anyone could read what the agents were doing.

Exclusion lists are an old habit among Russian-speaking operators, traditionally built around the former Soviet states. This one is broader. In GreyNoise's printed order it runs: Russia, China, Hong Kong, Thailand, Iran, Venezuela, Belarus, Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Moldova, Ukraine, Brazil, Vietnam, Indonesia, Pakistan, Tanzania, Bangladesh, Afghanistan, Turkey, South Africa, Namibia, Nigeria and Zimbabwe.

GreyNoise, which calls the operator an MCA — a malicious cyber actor — is honest about the limits of what it knows: "It's currently uncertain why the MCA's agents deviated, but it is a good example of Agents Gone Wild."

There is a pattern in the data worth stating carefully. None of the first sixteen countries on the list — including every one an operator like this would presumably care about most — appear among the victims. All six that were hit sit in positions 17 to 28. One reading is that a long instruction degrades towards its end. Another is simply that the scan data held fewer exposed PaperCut servers in the countries at the top. Nothing published distinguishes the two, and it should not be reported as a finding.

What can be stated is this: the operator wrote a rule, delegated its enforcement to software running faster than anyone could supervise, and the rule held imperfectly. That is the failure mode every organisation deploying its own agents is designing against, observed for once on the other side.

The old bugs did the heavy lifting

The tooling that got the attention is new. The escalation path that made it dangerous is not.

GreyNoise's defensive recommendations open with patching CVE-2021-42278 and CVE-2021-42287 — the 2021 Active Directory flaws usually known together as noPac. The research also notes that "Fundamental hardening of environments still matters against AI-enabled threats", and that in at least one case Cloudflare's web application firewall defeated the adversary outright.

The same week, Anthropic's own threat intelligence report put the trend in one line: "Sophisticated attacks no longer require sophisticated attackers." GreyNoise is the view of that sentence from the sensor side.

What to do

  • Patch PaperCut NG and MF against CVE-2026-81578 and CVE-2026-82078 if you have not. This campaign is the reason not to wait.
  • Patch noPac — CVE-2021-42278 and CVE-2021-42287 — on every domain controller. Five-year-old privilege escalation is still the shortest route from a print server to domain admin.
  • Put print management behind a web application firewall, or off the internet entirely. It has no business being findable in an internet scan.
  • Watch LSASS and registry access, enable Credential Guard, and alert on unexpected account creation — GreyNoise flags names like Administrator17.
  • Block and hunt for the published indicators, including command-and-control addresses 45.142.193.132 and 45.158.196.75 and the tunnelling tool ligolo-agent.exe.

What is not established

  • How GreyNoise obtained the operator-side detail — the exclusion list and the Codex and DeepSeek tooling. Its sensors observe attacks; the source of the configuration detail is not described.
  • Why the agents ignored part of the list, and whether the position pattern means anything at all.
  • Which DeepSeek model was used.
  • Attribution beyond "likely Russian-speaking" — a language assessment, not an identified group.
  • What was done with domain access in the 12 organisations where it was reached.