Hunt.io Says Open Directories on a PaperCut Campaign Host Exposed an AI Agent Workbench, a Second XML-RPC RCE Path and Reverse SOCKS Persistence Across Dozens of Domains

SINGAPORE - Hunt.io published a reconstruction on Oct. 15, 2026 of an AI-orchestrated campaign against PaperCut NG/MF print servers after its AttackCapture sensors found three open directories on the same Amsterdam orchestration host GreyNoise and Blackpoint Cyber had already tied to the operation, and the recovered files show not only the CVE-2026-81578 and CVE-2026-82078 exploit chain but a second remote-code path through PaperCut's XML-RPC API, Linux reverse SOCKS5 persistence with chisel, and packaged "kali kits" for dozens of already compromised Active Directory domains. GreyNoise's Sept. 9 report had put the campaign at least 440 compromised PaperCut instances across 395 organizations in 48 countries, with a likely Russian-speaking operator driving hundreds of AI agents through OpenAI's Codex harness and a DeepSeek model. Recorded Future's Insikt Group repeated those figures in its Oct. 16 September 2026 CVE Landscape note. Hunt.io's open-directory haul is the first public view of the operator's own workbench, and it hands SOC teams concrete paths, ports and artifacts that patching alone does not remove.

The host is 45.142.193.132, which Hunt.io places in AS213388 (IIC RAIL LIMITED) with a Netherlands geolocation. GreyNoise said it had tracked the address for malicious scanning since early July 2026. On that host, Hunt.io said AttackCapture recorded directory listings on ports 8000, 18080 and 18081. Port 8000 held about 377 files totaling roughly 192 MB of post-exploitation staging. Port 18080 held about 1,924 files across 97 subdirectories, about 3.9 GB, and that tree contained the pupercut workbench with AGENTS.md, exploit variants, target lists and timestamped state journals. Port 18081 held four files totaling about 15 MB: a 15.7 MB chisel binary, stage.sh, watch.sh and a socks-verify.txt liveness marker. Hunt.io said searches for the operator's distinctive filenames, including live_reverse_socks5.py, returned only this host, so the exposed tooling appears confined to a single orchestration server even though the files describe activity against hundreds of targets.

GreyNoise's timeline still supplies the speed of the first wave. PaperCut published its advisories for CVE-2026-81578, an unauthenticated path into an admin-only Tapestry component, and CVE-2026-82078, unsafe reflection in JDBC driver loading, on Aug. 27, 2026. On Aug. 31 the operator stood up a workspace, diffed vulnerable and patched installers, built multi-threaded checkers and a local Active Directory lab, and by 18:39 UTC had remote code execution on a real Australian target; domain administrator on that first victim followed by 21:00 UTC. On Sept. 1, GreyNoise said, hundreds of SSH sessions from a second execution host drove unauthorized access to 11 organizations in 26 seconds, with credential harvesting inside a minute and eight domain-administrator outcomes in the first hour. Overall GreyNoise attributed domain administrator to 12 of the 440 victims, with education the largest sector at 204 organizations. Blackpoint's Adversary Pursuit Group, which published the same day after containing exploitation of an internet-facing PaperCut Application Server and then finding the same exposed directory, described the recovered state files as a continuous research-to-campaign workflow that carried failures, retries and code changes forward from one AI session to the next.

Hunt.io's Figure 13 diagram and accompanying scripts fill in how the primary chain worked. An unauthenticated POST reaches ConfigEditor through a Tapestry Error page, CVE-2026-81578, and rewrites user-lookup.db-driver, user-lookup.db-url and user-lookup.id-to-username-sql. Against PaperCut 26.x the scripts abuse H2's INIT parameter to run Groovy; against 25.x and earlier they use Apache Derby's SYSCS_EXPORT_QUERY_LOBS_TO_EXTFILE to drop a compiled class into PaperCut's lib directory. CVE-2026-82078 is the unsafe Class.forName path that loads the attacker-chosen driver. A third variant, live_rce_web.py, writes command output to custom/web under a random name that PaperCut then serves at /custom/, deleting the file after 30 seconds, a pattern GreyNoise also published. Each script restores the lookup settings in a finally block, which Hunt.io said may help explain why the configuration looked unchanged after a successful run.

The recovered notes also document a second route that does not need the Tapestry bypass. When PaperCut's XML-RPC endpoint at /rpc/api/xmlrpc is reachable with a weak network allowlist or with no explicit API token, Hunt.io said the handler can fall back to the built-in administrator password. That is enough to call api.setConfigValue and api.lookUpUserNameByCardNo, after which the same Derby export path delivers code execution. The operator's own chain-validation notes, Hunt.io wrote, called it "a second local RCE chain proven when API network and token controls are weak" and "does not depend on the original Tapestry trigger." A companion probe listed nine live hosts across Taiwan, France, the United States, Brazil, Canada, South Africa and Germany where the API answered. For SOC teams that already patched the August CVEs, that means an exposed XML-RPC surface with weak API controls is still a hunt target.

On the Linux side of the same host, stage.sh creates /var/tmp/.rs_live46_v5, downloads chisel and watch.sh from 45.142.193.132:18081, stores an authentication token, installs cron entries including @reboot, and starts the supervisor. watch.sh keeps a chisel client connected to 45.142.193.132:18443 with TLS verification skipped and a 10-second keepalive, exposing a reverse SOCKS5 listener at 127.0.0.1:1083. Hunt.io said neither 18081 nor 18443 had been published in the earlier GreyNoise and Blackpoint write-ups. On Windows victims, the port 8000 directory held SECURITY and SYSTEM registry hive dumps, Rust collectors named lsa_collect.exe, lsa_read.exe, save_hives.exe and collect_custom.exe, decrypt_machine_hash.py for offline NT-hash recovery, Metasploit resource scripts that create local administrators and escalate to SYSTEM, and six kali-kits archives that package credentials, domain fingerprints and via_socks.sh wrappers for reuse. Hunt.io counted 46 distinct Active Directory domains across those kits and 45 targets with a live reverse SOCKS5 pivot at capture time; the actor's own geoip summary listed a reconnaissance pool of 1,005 hosts across at least 45 countries. The firm said it shared victim data with national CERTs before publishing and is not releasing raw IPs, session tokens or organization names.

For SOC and IR teams, the three vendors converge on a response that goes past installing PaperCut 26.0.5, 25.0.13, 24.1.10 or later. Hunt.io and Blackpoint both say to treat a suspected hit as a broader compromise: hunt for unexpected user-lookup.* configuration changes and for temporary files under custom/web; search Linux hosts for /var/tmp/.rs_live46_v5, unfamiliar watch.sh scripts and cron lines that keep chisel alive; look for PaperCut processes spawning cmd.exe, powershell.exe, whoami, wmic, sc, reg, esentutl or nltest; and sweep temporary directories for the published collector names and SocksBrd class and conf files. Disable or tightly restrict /rpc/api/xmlrpc rather than relying on the built-in admin password as a fallback. Rotate LDAP bind, database, keystore and machine-account secrets if LSA material may have been taken, and review Active Directory for unauthorized local administrators and DCSync-style enumeration. GreyNoise's sector table and Hunt.io's education-heavy domain naming both underline why schools, libraries and other print-heavy campuses should assume internet-facing PaperCut servers that were unpatched between mid-August and mid-September need an investigation, not only a version bump. Behavioral detections travel further than blocking 45.142.193.132 alone, because Hunt.io found the operator's distinctive tooling only on that host while GreyNoise and Blackpoint both warn that filenames, account names and ports are easy to change.