Rubeus

A Russian-speaking threat actor leveraged AI-powered agents to rapidly develop and deploy exploits for CVE-2026-81578 and CVE-2026-82078, targeting vulnerable PaperCut NG/MF servers. The campaign, active since August 31, 2026, compromised at least 440 servers across 395 organizations in 48 countries, with a focus on the education sector. Attackers achieved rapid domain compromise using techniques like pass-the-hash, noPac, and DCSync, often gaining full domain admin access within minutes. The actor used AI models such as OpenAI’s Codex and DeepSeek to accelerate exploit development and target selection via Netlas scanning.

A suspected Russian-speaking threat actor has exploited CVE-2026-81578 and CVE-2026-82078, a vulnerability chain in PaperCut NG/MF involving authentication bypass and remote code execution, to compromise at least 440 instances across 395 organizations in 48 countries. The attacker used AI agents powered by OpenAI Codex and DeepSeek, along with offensive tools like Mimikatz and Impacket, to automate exploitation and post-compromise activities including credential harvesting and domain reconnaissance. The campaign targeted primarily the education sector and demonstrated rapid lateral movement, with some attacks achieving domain administrator access in under seven minutes. The actor’s ultimate objectives remain unclear, though activity suggests potential initial access brokering or preparation for follow-on attacks such as data theft or ransomware.