The threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on them, PaperCut Software shared in the most recent update on the ongoing attack campaign.
PaperCut zero-days exploited to deploy remote access tools
The vendor first warned of in-the-wild compromises on August 27, 2026, when it urged customers using the PaperCut NG and MF print management solutions to “immediately restrict web access to trusted IP addresses only.”
At the time, PaperCut believed the threat actor exploited a previously unknown vulnerability to gain access and control over the solutions’ Application Server, but their investigation later revealed they leveraged two zero-day vulnerabilities:
- CVE-2026-81578, an improper access control vulnerability in the web management interface of PaperCut MF and PaperCut NG
- CVE-2026-82078, an unsafe dynamic class loading vulnerability in the database connection utilities of the two solutions
Chained together, the two flaws allowed the unauthenticated threat actor to bypass authentication, modify certain system configurations, and execute arbitrary Java bytecode under the security context of the PaperCut server process.
With the help of a university customer’s security and digital forensics and incident response teams, PaperCut Software reproduced the vulnerabilities, and pushed out emergency patches on August 28.
Later that same day, the vendor published a second round of emergency patches (with “additional hardening developed with internal security and external researchers”) and urged customers to apply them even if they had already applied the initial ones.
On August 30, they followed up by extending the initial list of provided indicators of compromise and shared a command sequence that shows what the attackers are doing after gaining access to the Application Servers:
- They list users and their privileges and running processes
- Enumerate domain controllers in the domain
- List logged-on user sessions
- Download a malicious payload from a file-sharing host (sendit.sh) into C:\ProgramData
- Silently install and run the payload, which installs SimpleHelp remote access software and sets it up to auto-start, and checks that it’s running
- Download AnyDesk to establish a second, redundant remote access channel
“As every customer environment is unique, it is difficult to identify a single consistent pattern of post-compromise activity, but observed behaviour includes the pc-app.exe (or pc-app) process launching child shell processes (cmd.exe) and running whoami & ver, with endpoint protection in some cases preventing further execution and isolating the machine,” PaperCut noted.
In cases where execution was not prevented, the attackers performed the above listed actions that ended with AnyDesk being installed.
Since PaperCut’s initial disclosure, Rapid7 published a technical overview of the vulnerabilities, watchTowr researchers discovered multiple patch bypasses and identified an additional authentication bypass vulnerability, which they reported to PaperCut.
Huntress analysts found evidence of exploitation in two customer environments, but the exploitation activity was limited. In one of the cases, the exploited instance was running PaperCut MF version 24.1.5.71847.
What should customers do?
The initial round of emergency patches for PaperCut NG and MF were made available only for the v25 and v26 branches, but the second one includes patches for the v24 branch.
Huntress researchers noted that “47% of the approximately 2,500 PaperCut installations Huntress tracks are running v23 or older, for which no patch is currently available.”
PaperCut advises customers running PaperCut NG/MF versions older than v24 to upgrade to the latest version.
“Site Servers and secondary/print servers should be updated to a patched version, not just the primary Application Server. Other components such as Print Deploy and Mobility Print are not affected and do not need to be updated,” the vendor added.
Huntress advises users to:
- Preserve forensic evidence before updating
- Implement the provided emergency updates and restrict web access to PaperCut Application Server to trusted IP addresses
- Review the preserved logs for known indicators of compromise
“We recommend checking for the presence of a Windows service named ‘Remote Access Service’ running SimpleService.exe from the [C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\ path], and for unexpected AnyDesk installations, as potential indicators of post-compromise remote access tooling,” PaperCut advised.
But, they also pointed out that the absence of already shared indicators of compromise doesn’t mean a system has not been affected. “PaperCut will publish validated, specific indicators and further guidance here as soon as they are available,” they added.
“If you suspect your server has been compromised, we recommend securing current server backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious behavior was detected. Additionally, you should activate your organization’s security response procedures and follow standard incident protocols.”
The attackers’ ultimate goal remains unknown.
Three years ago, Clop and LockBit affiliates exploited two known PaperCut vulnerabilities to compromise servers and deploy ransomware. This time the flaws were zero-days rather than known bugs, but today’s attackers have an additional edge: AI tools that can help them analyze target software, surface previously unknown vulnerabilities, and write working exploits.