440 Print Servers Fell. Only 12 Reached Domain Admin.

An AI agent swarm compromised 440 internet-facing print servers in 48 countries. It converted twelve of them into domain admin. That gap — not the 440, not the 26 seconds — is the only number in this campaign you can still do something about.

GreyNoise published the campaign on 9 September: a likely Russian-speaking actor ran hundreds of AI agents against PaperCut NG/MF, hitting at least 440 instances across 395 identified victim organizations. The agents ran on an OpenAI Codex harness with a DeepSeek model behind it, using Hindsight for persistent memory and AionUi to drive many agents at once, and they pulled their target list from the Netlas.io scanning service using an identified API key. Once the campaign launched, GreyNoise observed at least 11 organizations compromised in 26 seconds.

Twelve got to domain admin. Everyone else got their print server taken and stopped there.

---

26 Seconds Is Not a Patch Window

If your defensive plan for an internet-facing appliance is a faster patch SLA, this campaign already beat it, and it beat the vendor too. The operator went from an empty workspace to remote code execution against a real victim in under four hours, and to first domain admin two hours after that.

The vulnerabilities are real and they chain cleanly. CVE-2026-81578 is a missing-authentication flaw rated 8.8; CVE-2026-82078 is an unsafe reflection bug rated 9.4. The auth bypass lets an attacker modify system configuration parameters, which in turn enables "the execution of arbitrary Java bytecode residing on the application classpath" — pre-auth RCE on a box most organizations classify as low-criticality infrastructure.

CISA added both CVEs to the Known Exploited Vulnerabilities catalog on 31 August under Binding Operational Directive 26-04, with federal agencies instructed to remediate by 14 September. That is a two-week federal window on a bug that took an agent swarm 26 seconds to spend. We made the same point about Ray in August, and the arithmetic has not improved.

Roughly 1,000 PaperCut instances are still reachable from the public internet, a majority in North America and Europe, per ShadowServer data cited by SecurityWeek. Some of those will be patched this week. None of them will be patched in 26 seconds.

Twelve Out of 395 Is the Finding

The agents were extremely good at the first hop and mediocre at the second, and nobody is reporting that half of it. GreyNoise recorded credential harvesting on 280 instances and OS or domain secrets recovered on 147 — and domain admin against exactly 12 victim organizations.

Read those three numbers as a funnel. Initial access was close to free. Credential theft worked on about two-thirds of victims. Full directory compromise landed on roughly one in thirty-three. Where it did land, it landed hard: GreyNoise clocked a fastest time of five minutes from initial access to domain admin and a longest of 144 minutes, including one instance that went start-to-finish in seven minutes against a high school in the United States.

Education was the bulk of the victim set — 204 organizations, and 7 of the 12 domain admin outcomes. That is not because agents like schools. It is because school districts run internet-facing print management with a domain-joined service account and a flat directory, and because their IT teams are three people.

The tooling on the second hop was entirely conventional: Mimikatz for credentials, SharpHound and BloodHound for directory enumeration, Certipy and Certify against AD Certificate Services, Rubeus, Impacket and NetExec for movement, Ligolo-ng for tunnelling. GreyNoise mapped three escalation paths — LSASS harvesting into pass-the-hash, noPac (CVE-2021-42278 and CVE-2021-42287), and simply adding a new account to Domain Admins — all converging on DCSync to pull NTDS.DIT.

Nothing there is new. Nothing there is AI. The model wrote the exploit and drove the fleet; the privilege escalation was 2021-era offensive tradecraft against 2015-era directory hygiene. The novelty is the parallelism, which is the same pattern we saw when 1,200 agents met on a message board inside Artifactory and when one operator ran 5,317 commands against nine agencies.

Your Print Server Is Tier 1 With Tier 0 Rights

For some of the twelve, what the PaperCut Application Server was running as is the entire explanation. GreyNoise says it plainly: "If the compromised PaperCut host was on the Domain Controller itself or running as a Domain-Admin service account, the adversary simply added its newly created account to Domain Admins."

No exploit chain. No lateral movement. An Administrator17 account added to a group.

That is one of three escalation paths in the report, and GreyNoise does not break down how many of the twelve went each way. The other two — LSASS harvesting into pass-the-hash, and noPac — can beat a properly scoped service account too. But they require winning an exploitation step first. This one requires only the group membership.

This is a tiering failure, and it has a name. Microsoft's AD DS tier model puts domain controllers and AD CS in Tier 0, member servers and line-of-business applications in Tier 1, and end-user devices in Tier 2. A print management server is a Tier 1 asset. The model's stated anti-patterns include "shared service accounts across tiers" — "a service account used on both Tier 0 and Tier 1 servers turns every Tier 1 server into a Tier 0 credential exposure point" — and its guidance for Tier 1 migration is to "identify overused and over-permissioned service accounts, and split them to reduce blast radius."

Microsoft's stated best practice for keeping Tier 0 small names "a common target" of "fewer than five people with Domain Admins-equivalent access, and no Domain Admins service accounts." The broader Enterprise Access Model states the same requirement as a hierarchy rule: "enforce hierarchy — to prevent control of higher planes from lower planes (via attacks or abuse of legitimate processes)."

Here is where the asset-tier ranking your patch programme uses collides with the identity tier that actually matters. On a patch priority list, a print server is tier 3: low business criticality, patched monthly, first thing deferred when a change window is tight. In the directory, the same box may hold a credential that controls everything. The two tiering systems disagree, nobody reconciles them, and the disagreement is invisible until an agent swarm prices it.

Service-account sprawl is not a print-server problem either. It is the same failure we documented when Snowflake agents inherited every role granted to PUBLIC and when an agent's credential survived a refusal because the next session just re-used it. One over-scoped identity, attached to a machine, held forever.

PaperCut Shipped Three Patches in Five Days

Steel-man the patch argument properly: the vendor did close to everything right, and the agents still got 440 instances. PaperCut's own account of the incident is worth reading as an operational artifact.

At 9:42 a.m. AEST on Thursday 27 August, PaperCut received a report from an education-sector customer about a compromised server. A second organization reported similar activity at 5:05 p.m. the same day. CEO Chris Dance: "The first 48 hours were intense. People worked through the night."

Emergency Patch Release 1 shipped at 02:10 AEST on 28 August. Release 2 landed the same day with "additional hardening developed after further analysis with its internal security team and researchers at Huntress and watchTowr", covering versions 24, 25 and 26 on Windows, Linux and macOS. Release 3 arrived on 1 September, fixing two regressions and adding further mitigation. Full security maintenance releases — 26.0.5, 25.0.13 and 24.1.10 — replaced all three emergency patches on 10 September. The advisory has been updated throughout.

Dance on the sequencing: "We chose to release useful protection as soon as we had it, rather wait for a single perfect fix while customers remained exposed." That is the right call, and it is also why there were three patches. Shipping fast means shipping incrementally, and incrementally means your change board sees the same product three times in five days.

Now put yourself on the receiving end. Your team has to notice the advisory, test it against a print environment nobody wants to break at term start, and repeat that twice more — while watchTowr's threat intelligence lead is telling reporters that if a system was "exposed to the Internet and unpatched at any stage in the last few days," it "should be assumed compromised by an active attacker who is combing through vulnerable hosts." And note what the advisory says about scope: Site Servers and secondary print servers need upgrading too, not just the Application Server.

There is no version of that process that outruns 26 seconds. The patch race is worth running. It is not a control.

What Actually Stopped the Agents

Two things beat the swarm in this campaign, and neither was detection. The first was a network control: GreyNoise reports that "in at least one instance of targeting a perceived vulnerable PaperCut instance, Cloudflare's Web Application Firewall (WAF) defeated the adversary." The appliance was never reachable in a usable form.

The second was containment. 383 organizations lost a print server and kept their directory. GreyNoise's own conclusion is the least fashionable sentence in the report: "Fundamental hardening of environments still matters against AI-enabled threats."

The third thing worth noting is that the agents were sloppy in a way that should temper the panic. The operator maintained a list of 28 countries to avoid; the agents hit Brazil, Kazakhstan, Nigeria, Namibia and Zimbabwe anyway. That is the title of the report — "Agents Gone Wild" — and it is the same instruction-drift failure enterprises keep finding in their own fleets. An agent swarm is fast, cheap and parallel. It is not disciplined.

Which is the argument against buying your way out of this. The market response to an AI-orchestrated campaign will be AI-attack detection, and the vendor pitch will be that only a machine can catch a machine. Maybe. But detection has to work at 26-second timescales to matter on the first hop, and on the second hop — the one that took five to 144 minutes and failed against 383 of 395 victims — you already have the control. It is an ACL.

Cut the Second Hop, Starting This Week

Three horizons. Every item produces an artifact someone can check.

This Week:

1. Find every domain-joined appliance whose service account is a member of Domain Admins, Enterprise Admins, Backup Operators or Server Operators. Print management, badge and access control, MFP fleet management, facilities, AV, digital signage, UPS monitoring. Produce a list with a named owner per row. This is a one-afternoon BloodHound or PowerShell job and it is the single highest-value output of this incident.
2. Patch PaperCut to 26.0.5, 25.0.13 or 24.1.10 — the maintenance releases, not an emergency patch — and include Site Servers and secondary print servers. If you are a federal agency, the KEV deadline is 14 September.
3. Assume compromise for any instance that was internet-exposed and unpatched between 27 August and your patch date. Hunt for an added local or domain account (GreyNoise names Administrator17), ligolo-agent.exe in C:\ProgramData, and staged registry hives named pc-sys.hiv, pc-sec.hiv, pc-security.hiv or pc-system.hiv. Patching does not evict a resident.
4. Take the Application Server off the public internet or put a WAF in front of it. A print queue does not need an inbound path from 48 countries.

This Month:

1. Split every over-scoped appliance service account. Microsoft's guidance is explicit: no Domain Admins service accounts. Most of these need read access to an OU for user sync and local admin on one host — not directory-wide rights. Use a group Managed Service Account, scope the delegation, and log the change.
2. Reconcile your two tier systems. Put the patch-priority tier and the identity tier of every server in one spreadsheet, and flag every row where a low patch tier sits next to a high identity tier. Those rows are your real exposure ranking.
3. Run a BloodHound path query from each appliance's computer object to Domain Admins. If a path exists, the number of hops is your actual blast radius. Track it as a metric; it should trend down.
4. Put a detection on Domain Admins group membership change. Path C in this campaign was literally that, and a group-add alert fires on it with no tuning.

Before Renewal:

1. Ask every appliance vendor, in writing, the minimum privileges their service account requires and whether a gMSA is supported. Answers vary enormously and almost nobody asks.
2. Add a least-privilege attestation to the renewal checklist for any product that domain-joins. If the vendor's install guide tells you to grant local admin plus network share rights, that is a procurement finding, not a footnote.

The Bottom Line

The interesting thing about this campaign is not that AI ran it. Attacks have been automated for thirty years; the agents here bought parallelism and a shorter exploit-development cycle, and they drifted off their own operator's country list while doing it. The interesting thing is that we finally have per-victim outcome data for a swarm, and it says the first hop is lost and the second hop is winnable.

Speed is now the attacker's. Structure is still yours. A compromised print server should be a bad Tuesday, not a directory rebuild — and the difference between those two outcomes is a decision somebody made years ago about what a service account could reach, usually without writing it down. That is the same unowned machine identity problem every enterprise already has, attached this time to a box in a cupboard.

Go find out what yours can reach. It takes an afternoon, and 383 organizations just proved it is the control that held.

Continue Reading

• CISA Gave 3 Days to Patch Ray. Auth Is Still Off by Default.
• 1,200 Agents Met in Artifactory. Go Log Repo Creation.
• 5,317 AI Commands. 9 Agencies Breached. By One Person.
• Cursor Refused. The Next Chat Didn't. Scope the Creds.
• Snowflake Agents Run as All Your Roles. Revoke From PUBLIC.
• AI Wrote the S7 Exploit. There Is No CVE to Patch.
• 9 in 10 Enterprises Breached Through Identity No One Manages