We covered the PaperCut emergency patch on 29 August, when the notable fact was that one of the indicators of compromise was your server log being missing.

On 5 September the Arctic Wolf Adversary Research Team published what the attackers do once they are in, against K-12 schools and universities in the United States and Europe. It is worth its own piece, because the post-exploitation steps say something the advisory did not.

The two flaws are a pair, and that is the point

CVE-2026-81578 — CVSS 8.8, improper access control in the web management interface. Requests aimed at administrative functions trigger backend actions before access validation completes, letting an unauthenticated remote attacker modify certain system configuration.

CVE-2026-82078 — CVSS 9.4, unsafe dynamic class loading in the database connection utilities. The application instantiates database driver classes from configurable driver names, without validating them against an allowlist.

Read those in order and the chain assembles itself. The first flaw gives you an unauthenticated write to configuration. The second turns a configuration value into a class the application will load and run.

One supplies the pen, the other supplies the paper. Neither alone is the incident.

The first patch lasted about 48 hours

PaperCut issued its urgent bulletin on 27 August 2026. Within roughly 48 hours it shipped a second one — Emergency Patch Release 2 — because attackers had found a way around the first fix. That release adds hardening and extends coverage to the 24.x line.

CISA added both CVEs to the Known Exploited Vulnerabilities catalogue on 31 August.

If you patched in that first 48-hour window and stopped there, you are not patched. That is the single most important sentence in this article.

What they do next

Arctic Wolf's documented sequence, once code execution lands:

  • Ordinary reconnaissance — uname, whoami, ver, tasklist
  • Creation of a privileged account, in observed cases named Administrator17
  • Credential harvesting with lsa_collect.exe, lsa_collect_small.exe and save_hives.exe
  • Registry key extraction targeting the SAM database
  • A Meterpreter Java payload for persistent access

And then the step that reframes the whole incident:

They search the PaperCut configuration files for the strings "password", "secret", "ldap", "bind" and "token".

The print server is a credential store

Nobody's threat model has the print server on it. It is the box that manages quotas and release stations, it is bought by the operations team, and it is patched on whatever cycle facilities management runs.

It is also, in almost every school and university, domain-joined and configured with an LDAP bind account — because that is how it knows who is standing at the printer.

That bind account is not a nobody. Depending on how it was set up, and setups from a decade ago were generous, it can enumerate the directory. Sometimes considerably more.

The attackers are not grepping for "ldap" and "bind" by accident. The SAM dump gets them local hashes; the config grep gets them the credential that reaches the rest of the estate. The print server is the doorway, not the destination.

This is the second time PaperCut has been the doorway. That was worth saying in August and it is worth saying again now that the objective is visible.

Indicators

From Arctic Wolf's reporting:

  • 45.142.193[.]132 — the address requesting harvested data
  • 194.180.48[.]134 — the Meterpreter command server
  • File paths /custom/pcp_*.txt and /custom/web/pcp_*.txt
  • The account name Administrator17

The account name is the most durable of these and the easiest to search for right now. The addresses will rotate.

What to do

  • Confirm you are on Emergency Patch Release 2, not the first patch. The first was bypassed in two days.
  • Search your directory for accounts created since 27 August, starting with anything shaped like Administrator17.
  • Rotate the PaperCut LDAP bind credential. If your server was internet-facing and unpatched at any point in the past ten days, treat that credential as disclosed. Rotate it before you finish reading the rest of this list.
  • Then look at what the bind account can actually do. Most were granted more than they need, years ago, by someone who has left.
  • Take the management interface off the public internet. There is no version of this product that needs its admin surface exposed.
  • Check for the file paths and the two addresses, and remember from the earlier reporting that missing logs are themselves an indicator.

What is not established

  • How many organisations were compromised. No count has been published.
  • Whether the operators are one group or several. Arctic Wolf describes activity, not attribution.
  • Whether data was exfiltrated beyond credentials, or whether this is staging for ransomware.
  • When exploitation actually began. The bulletin is dated 27 August; the start of activity is not established.
  • Whether the second patch holds. The first one did not.