PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking attacker used hundreds of AI agents (powered by OpenAI Codex and DeepSeek models) to exploit two security flaws in PaperCut NG/MF software, compromising over 440 instances across 395 organizations in 48 countries, primarily targeting the education sector. The attacker combined AI-driven exploit development with offensive security tools to gain remote access and harvest credentials, sometimes achieving full administrative control in just minutes. The attacker's ultimate goals remain unclear, though the activity suggests either initial-access development or preparation for data theft or ransomware attacks.