Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Attackers are actively exploiting two PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) — an authentication bypass chained with remote code execution — to compromise education sector systems in the U.S. and Europe. Post-exploitation activity includes credential harvesting via tools like lsa_collect.exe and save_hives.exe, registry hive collection, Meterpreter Java payload delivery, and privileged account creation (e.g., "Administrator17"). Attackers search PaperCut config files for se
Analysis
TL;DR
- Attackers are actively exploiting two PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) — an authentication bypass chained with remote code execution — to compromise education sector systems in the U.S. and Europe.
- Post-exploitation activity includes credential harvesting via tools like lsa_collect.exe and save_hives.exe, registry hive collection, Meterpreter Java payload delivery, and privileged account creation (e.g., "Administrator17").
- Attackers search PaperCut config files for sensitive terms such as "password," "secret," "ldap," "bind," and "token" to extract credentials that can pivot into other critical systems.
- The threat actor infrastructure includes C2 servers at 45.142.193[.]132 and 194.180.48[.]134, with data exfiltration occurring through custom file paths on compromised hosts.
- Arctic Wolf recommends restricting PaperCut server internet exposure and monitoring for suspicious cmd.exe/powershell.exe execution with pc-app.exe as the parent process.
Why It Matters
This incident highlights the cascading risk of unpatched vulnerabilities in widely deployed enterprise software within critical infrastructure sectors like education. The authentication bypass-to-RCE chain demonstrates how a single misconfigured or outdated service can become an initial access vector for full environment compromise, making patch management and network segmentation essential priorities for security teams.
Technical Details
- Vulnerabilities exploited: CVE-2026-81578 (authentication bypass) chained with CVE-2026-82078 (remote code execution), enabling unauthenticated attackers to achieve command execution on vulnerable PaperCut servers.
- Post-exploitation toolkit: Attackers deployed Windows registry hive collection tools (lsa_collect.exe, lsa_collect_small.exe, save_hives.exe), Metasploit/Meterpreter Java payloads, and used certutil.exe for legitimate-looking binary delivery.
- Credential harvesting methodology: Attackers used findstr to grep PaperCut .config files for keywords ("password," "secret," "ldap," "bind," "token"), extracted BootKey from registry to access the SAM database, and exfiltrated data via GET requests to /custom/pcp_.txt and /custom/web/pcp_*.txt endpoints.
- Reconnaissance commands: Standard enumeration tools and commands were observed, including uname, whoami, ver, tasklist, and findstr, indicating systematic host and user discovery.
- Detection guidance: Monitor for cmd.exe/powershell.exe spawned by pc-app.exe, and look for the specific IOCs including the C2 IPs 45.142.193.132 and 194.180.48.134.
Industry Insight
- Organizations should treat PaperCut servers as high-priority assets: immediately patch vulnerable versions, restrict internet exposure, and enforce network segmentation to limit lateral movement from any compromise.
- The education sector remains a soft target due to limited IT security resources; institutions should prioritize vulnerability management for third-party applications and implement behavioral monitoring rather than relying solely on signature-based detection.
- The use of legitimate tools (certutil.exe) and custom exfiltration paths over HTTP demonstrates the need for egress filtering and DNS/HTTP traffic inspection to detect data staging and C2 communication patterns.
Disclaimer: The above content is generated by AI and is for reference only.