Full Report
Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as well as
Analysis Summary
# Incident Report: PaperCut Vulnerability Exploitation Targeting Education Sector
## Executive Summary
Threat actors are actively exploiting a vulnerability chain in PaperCut print management software to target K-12 and university environments across the U.S. and Europe. The attack leverages an authentication bypass and remote code execution (RCE) to deploy credential-harvesting tools and gain persistent access to Windows environments. The primary outcome is the theft of system credentials (SAM database) and sensitive configuration data, potentially leading to broader network compromise.
## Incident Details
- **Discovery Date:** September 05, 2026 (Public disclosure by Arctic Wolf)
- **Incident Date:** Observed throughout August and September 2026
- **Affected Organization:** Multiple Educational Institutions (K-12 through Universities)
- **Sector:** Education
- **Geography:** United States and Europe
## Timeline of Events
### Initial Access
- **Date/Time:** August/September 2026
- **Vector:** Exploitation of CVE-2026-81578 (Authentication Bypass) and CVE-2026-82078 (Remote Code Execution).
- **Details:** Attackers chained these vulnerabilities to bypass security controls on internet-exposed PaperCut servers and execute arbitrary commands.
### Lateral Movement
- **Movement:** Attackers created privileged local accounts (e.g., "Administrator17") to establish a foothold.
- **Tools:** Use of Metasploit/Meterpreter Java payloads to establish reverse sessions for command-and-control (C2).
### Data Exfiltration/Impact
- **Impact:** Harvested system and user data were written to `.txt` files in the `/custom/` web directory for external retrieval.
- **Theft:** Targeted extraction of Windows registry hives (SAM, SYSTEM, SECURITY) to obtain the system BootKey and decrypt the SAM database for password hashes.
### Detection & Response
- **Discovery:** Detected by Arctic Wolf Adversary Research Team via behavioral analysis and sandbox observation of malicious tools.
- **Response Actions:** Public advisory issued to patch PaperCut, restrict internet exposure, and monitor for specific process parent-child relationships (e.g., `pc-app.exe` spawning `cmd.exe`).
## Attack Methodology
- **Initial Access:** CVE-2026-81578 / CVE-2026-82078 exploitation.
- **Persistence:** Creation of new privileged local administrator accounts.
- **Privilege Escalation:** Registry hive dumping to access the SAM database.
- **Defense Evasion:** Use of native Windows tools like `certutil.exe` to download payloads and `findstr` for searching configuration files.
- **Credential Access:** Execution of `lsa_collect.exe`, `save_hives.exe`, and searching `*.config` files for "password," "secret," and "ldap."
- **Discovery:** Execution of reconnaissance commands: `whoami`, `tasklist`, `ver`, and `uname`.
- **Lateral Movement:** Meterpreter Java payloads used for session establishment.
- **Collection:** Consolidating system info into `pcp_*.txt` files in web-accessible directories.
- **Exfiltration:** Inbound GET requests from attacker infrastructure to pull harvested text files.
- **Impact:** Potential for full domain compromise following the theft of administrative credentials.
## Impact Assessment
- **Financial:** Unknown; potential for high costs associated with forensic recovery and identity monitoring for staff/students.
- **Data Breach:** High risk; theft of system credentials and potentially LDAP/Active Directory bind secrets.
- **Operational:** Disruption of print management services; required emergency patching and credential resets.
- **Reputational:** Significant; education sector remains a high-profile target for data privacy concerns.
## Indicators of Compromise
- **Network Indicators:**
- 45.142.193[.]132 (Payload delivery and data exfiltration)
- 194.180.48[.]134 (Meterpreter C2)
- **File Indicators:**
- `lsa_collect.exe`
- `lsa_collect_small.exe`
- `save_hives.exe`
- `pcp_*.txt` (in PaperCut /custom/ directories)
- **Behavioral Indicators:** `pc-app.exe` spawning `cmd.exe`, `powershell.exe`, or `certutil.exe`.
## Response Actions
- **Containment:** Restrict PaperCut web interface access to authorized internal IP ranges only.
- **Eradication:** Delete unauthorized local accounts (e.g., "Administrator17") and remove malicious binaries.
- **Recovery:** Update PaperCut to the latest patched version; rotate all service account passwords and secrets found in `.config` files.
## Lessons Learned
- **Visibility:** Legacy or "utility" applications like print managers are high-value targets often overlooked in monitoring.
- **Vulnerability Management:** Rapid patching of RCE chains is critical, especially for internet-facing software.
- **Egress/Ingress Filtering:** Monitoring for `certutil` downloading files from unknown external IPs could have alerted teams earlier.
## Recommendations
- **Zero Trust:** Do not expose the PaperCut administrative dashboard to the public internet.
- **Endpoint Detection:** Implement EDR rules to flag suspicious parent-child process relationships originating from the PaperCut service (`pc-app.exe`).
- **Hardening:** Regularly audit local administrator groups for unauthorized additions.