AI-Powered Assault Takes Over Hundreds of PaperCut Servers Worldwide

A Russian‑language threat actor group is believed to have orchestrated a unified cyber campaign that used AI tools to breach a minimum of 395 entities across the globe, taking advantage of flaws in PaperCut NG and MF print‑management servers.

PaperCut, a print‑management solution commonly deployed by corporations, schools and government bodies to track and regulate printing, operates on on‑premises servers that typically store user‑activity logs, authentication tokens and document metadata. Positioned at the crossroads of network connectivity and confidential data, these servers become a prized target for threat actors aiming to siphon internal information or expand their foothold.

The probe revealed that the perpetrators unleashed hundreds of self‑directing AI bots to streamline the hunt for insecure PaperCut deployments. These bots probed public IP blocks, pinpointed machines running obsolete or mis‑configured software versions, and crafted exploit payloads without human hands‑on. Such AI‑driven tactics let the actors expand the operation swiftly, progressing from early footholds to full takeover of numerous targets.

Although analysts are still gauging the breach’s total scope, the infiltrated servers may reveal data like the titles of printed documents, user IDs, and SSO authentication credentials. Researchers caution that these details could be exploited for credential‑stuffing campaigns, espionage activities, or additional lateral movement inside the affected networks.

In response, PaperCut’s developers have issued security patches and advisories that call on administrators to install the fixes, adopt robust authentication, and isolate print‑management services from vital network zones. Multiple cyber‑security vendors have also published recommendations for spotting the AI‑crafted exploitation signatures, suggesting continuous monitoring for irregular scanning behavior and unusual outbound traffic originating from print servers.

This incident highlights an emerging pattern of threat actors using generative AI to speed up vulnerability discovery and exploit creation. As AI capabilities become increasingly reachable, defenders must grapple with forecasting automated attack paths and bolstering the security posture of legacy systems that were not built with AI‑centric threats in mind.