PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and GreyNoise, the activity originates from IP address 45.142.193[.]132, which has been linked to the actor. The attacker reportedly used hundreds of AI agents to develop and deploy exploits, compromising over 440 PaperCut instances globally. The vulnerabilities exploited are CVE-2024-27198 and CVE-2024-27199, which affect PaperCut NG/MF. The exact method of AI-assisted exploit development is not detailed, and the claim of 'hundreds of AI agents' has not been independently verified. PaperCut has released patches for these vulnerabilities, and organizations are urged to apply the latest updates and monitor for indicators of compromise. The full extent of data loss or operational disruption is not detailed, but the compromise could lead to unauthorized access, data theft, or further malicious activity. The attribution to a Russian-speaking actor is based on independent reports from Blackpoint Cyber and GreyNoise; the identity of the actor is not fully confirmed. The number of compromised instances (440+) is reported by these sources and may be subject to change.