Cybercriminals are actively exploiting recently disclosed vulnerabilities in PaperCut software to compromise organizations across the education sector, with attacks observed against institutions ranging from K-12 schools to major universities in the United States and Europe. The campaign demonstrates how vulnerabilities in widely deployed administrative software can quickly become an entry point for credential theft, reconnaissance, privilege escalation, and potentially much broader attacks against enterprise networks.
Researchers from the Arctic Wolf Adversary Research Team observed threat actors exploiting two PaperCut vulnerabilities, tracked as CVE-2026-81578 and CVE-2026-82078. When chained together, the flaws provide an authentication bypass and remote code execution path that can allow attackers to execute commands on vulnerable systems without first obtaining legitimate credentials.
The attacks are particularly concerning because exploitation does not appear to end with simply demonstrating access to the affected PaperCut servers. Arctic Wolf observed attackers immediately performing reconnaissance, collecting information about compromised systems, creating privileged accounts, searching configuration files for sensitive information, and deploying tools capable of extracting credentials from Windows environments.
Among the commands identified during the intrusions were familiar system-discovery utilities such aswhoami,tasklist,ver, anduname. These commands allow attackers to rapidly understand the environment they have compromised, including the operating system, current user context, running processes, and other information that can help determine what should happen during the next stage of an intrusion.
Researchers also observed the creation of a privileged account namedAdministrator17. Creating a new administrative identity can provide attackers with another method of maintaining control over a compromised system, particularly if defenders later discover and close the original vulnerability used to enter the environment. It also demonstrates that the attackers are interested in establishing more durable access rather than merely conducting automated vulnerability scanning.
Another component of the activity involved requests associated with the IP address45.142.193[.]132. Attackers were observed requesting files with patterns such as/custom/pcp_*.txtand/custom/web/pcp_*.txtfrom compromised hosts, with those files containing harvested system and user information. The behavior indicates a structured process for gathering reconnaissance data and retrieving it from affected PaperCut installations.
Credential theft appears to be one of the most important objectives of the campaign. Arctic Wolf identified tools includinglsa_collect.exe,lsa_collect_small.exe, andsave_hives.exebeing delivered through the legitimate Windows utilitycertutil.exe. Abuse of built-in operating-system utilities can help attackers reduce their dependence on custom download mechanisms while blending some malicious activity with tools administrators may legitimately use.
One of the detected tools,lsa_collect.exe, was analyzed in a sandbox and found to extract specific Windows Registry keys required to reconstruct the system BootKey. Obtaining this information can ultimately help attackers access the Security Account Manager database, which stores password-related information for local Windows accounts. This turns an initial application compromise into an opportunity to obtain credentials that may remain useful far beyond the affected PaperCut server.
Attackers were also seen deliberately searching PaperCut configuration files for sensitive strings. Using the Windowsfindstrcommand, they looked through*.configfiles for terms associated with valuable authentication material, includingpassword,secret,ldap,bind, andtoken. This suggests the attackers were attempting to identify credentials and integration secrets that could provide access to other systems connected to the compromised PaperCut deployment.
This stage of the intrusion is particularly significant because application servers frequently contain credentials needed to communicate with external infrastructure. A print-management platform integrated with directory services or other enterprise applications may hold configuration information that becomes extremely valuable once an attacker obtains administrative access to the underlying server.
A compromised PaperCut server should therefore not be viewed as an isolated print-management incident. If attackers recover LDAP credentials, service-account passwords, authentication tokens, or other secrets from the system, those credentials could provide a pathway into identity infrastructure, file servers, administrative applications, or other services available within the organization’s network.
Arctic Wolf specifically warned that stolen logins could allow attackers to move toward additional critical systems. This possibility transforms the security implications of the PaperCut vulnerabilities from application compromise into a broader identity and lateral-movement problem, particularly when organizations reuse credentials or grant service accounts more privileges than strictly necessary.
The researchers also detected activity associated with Metasploit and Meterpreter, well-known tools used by penetration testers but frequently abused by malicious actors. Java-based Meterpreter payloads were retrieved from infrastructure associated with194.180.48[.]134, and compromised systems subsequently established sessions with that infrastructure.
Meterpreter can provide attackers with a powerful interactive environment after exploitation. Depending on the privileges available, operators may use it to perform additional reconnaissance, manipulate files, execute commands, collect credentials, pivot toward other systems, or deploy additional malicious components. Its presence therefore provides another indication that attackers are attempting to turn vulnerable PaperCut installations into footholds for more extensive network compromise.
The education sector represents an especially attractive target for campaigns of this kind. Schools and universities frequently operate large and heterogeneous technology environments containing thousands of user identities, student systems, administrative applications, research infrastructure, shared computers, legacy software, and numerous externally accessible services.
Universities can present an even more complicated security challenge because their networks are often designed to support openness and collaboration. Students, researchers, faculty members, contractors, visitors, and administrators may all require different levels of access, while research projects can introduce specialized hardware and software that does not always follow centralized IT standards.
Print infrastructure can easily receive less security attention than systems traditionally considered critical, despite often being deeply integrated into these environments. Enterprise printing platforms may communicate with directory services, authentication systems and large numbers of endpoints, making them potentially valuable targets when vulnerabilities provide remote access.
The campaign also demonstrates why internet-facing administrative software deserves particular attention from vulnerability-management teams. Once technical details about a remotely exploitable vulnerability become available, the period between disclosure and widespread exploitation can be extremely short. Attackers can scan the internet for vulnerable installations and automate significant parts of the initial exploitation process.
Organizations therefore cannot rely solely on traditional patch cycles when vulnerabilities provide authentication bypass or remote code execution capabilities. Systems exposed directly to the internet should receive priority based not only on their CVSS score but also on whether exploitation is occurring in the wild, whether authentication is required, and what privileges an attacker can obtain after compromise.
Arctic Wolf recommends restricting PaperCut servers from direct internet exposure wherever possible. Reducing external accessibility can dramatically decrease the number of attackers capable of reaching a vulnerable instance and provides an important additional layer of protection even when patch deployment is delayed.
Security teams should also monitor PaperCut environments for suspicious command execution. Arctic Wolf specifically recommends looking for processes such ascmd.exe,powershell.exe, and other command or scripting interpreters, particularly when they appear withpc-app.exeas their parent process. Commands containing strings such aswhoami,tasklist,ver, oruname -acan provide additional indicators of exploitation and post-compromise reconnaissance.
Process relationships can be especially useful for detection because individual commands such aswhoamiare not inherently malicious. Administrators and legitimate applications may execute them during normal operations. However, seeing a print-management application unexpectedly spawning command interpreters and reconnaissance utilities provides considerably stronger behavioral evidence that something unusual is occurring.
Organizations that discover indicators of exploitation should assume that simply patching the vulnerable PaperCut instance may not be sufficient. Once attackers have executed commands and deployed credential-harvesting utilities, the security problem extends beyond the original vulnerabilities because credentials, tokens, newly created accounts, or additional persistence mechanisms may already exist elsewhere in the environment.
Incident response should consequently include a review of privileged and service accounts accessible from the compromised server, investigation of authentication activity originating from the affected host, examination of newly created users, and analysis of connections to suspicious external infrastructure. Credentials or secrets stored in PaperCut configuration files should be considered potentially exposed and rotated when compromise is confirmed.
Security teams should also investigate whether the affected system communicated with domain controllers, directory services, management interfaces, file servers, cloud services, or other sensitive infrastructure after the suspected exploitation period began. This can help determine whether attackers successfully moved beyond the initial PaperCut host.
The attack campaign reinforces a broader cybersecurity lesson: infrastructure applications can become valuable bridges between an external vulnerability and an organization’s internal identity systems. The application itself may not contain the organization’s most valuable data, but the credentials and connectivity surrounding it can provide attackers with exactly what they need to continue an intrusion.
This makes credential hygiene an important secondary defense against application vulnerabilities. Service accounts should receive only the privileges they require, passwords should not be unnecessarily reused, sensitive secrets should be protected appropriately, and organizations should understand which systems can access their identity infrastructure.
Segmentation can further limit the consequences of exploitation. A compromised print-management server should not automatically have unrestricted connectivity to every sensitive service inside the network. Controlling east-west communication and limiting administrative protocols can make it substantially more difficult for an attacker to convert control of one application into control of the broader environment.
The PaperCut attacks also show why defenders increasingly need to focus on what happens after exploitation rather than relying entirely on prevention. Even when organizations cannot patch every vulnerable system immediately, endpoint telemetry, process monitoring, network detection and identity analytics can provide opportunities to identify malicious behavior before attackers achieve their ultimate objective.
In this campaign, activities such as spawning command interpreters from PaperCut processes, creating unexpected administrator accounts, downloading credential-dumping utilities, searching configuration files for secrets, and communicating with unusual external infrastructure all provide potential detection opportunities. Combining these signals can help defenders identify an intrusion even when the original exploitation itself was not observed.
For schools and universities currently operating PaperCut infrastructure, the immediate priority should be determining whether affected systems are externally reachable and whether they have already exhibited signs of compromise. Because active exploitation has been observed against educational organizations in both the United States and Europe, vulnerable deployments should be treated as an immediate security concern rather than a theoretical risk.
Ultimately, the danger presented by CVE-2026-81578 and CVE-2026-82078 is not limited to unauthorized access to a printing application. The observed attack chain demonstrates how adversaries can move rapidly from remote exploitation to system reconnaissance, administrative account creation, credential harvesting and interactive post-exploitation activity.
For defenders, that progression changes the appropriate response. Protecting PaperCut is not simply about securing printers or keeping a management console online; it is about preventing an internet-facing application from becoming the first step toward compromise of identities and critical systems across the organization. The campaign targeting schools and universities is another reminder that once attackers obtain remote code execution, the vulnerability that provided entry is often only the beginning of the incident.