A single attacker used hundreds of AI agents to breach 395 organizations in hours

GreyNoise published research on September 9, 2026 describing a campaign in which one attacker, assessed as likely Russian-speaking, chained an authentication-bypass flaw (CVE-2026-81578) with a remote-code-execution flaw (CVE-2026-82078) in PaperCut NG/MF print management software and ran the exploitation through hundreds of AI agents. The agents ran on an OpenAI Codex harness driving a DeepSeek model, wrapped around public offensive-security tools including Mimikatz, SharpHound, Certipy, Rubeus, and Impacket. By GreyNoise's count, the campaign compromised at least 440 PaperCut instances across 395 organizations in 48 countries. Education accounted for 204 of the victims.

The timeline

The attacker built a private lab (a vulnerable copy of PaperCut NG/MF paired with an Active Directory server) to develop and test the exploit chain, and used the Netlas.io internet-scanning service to build target lists. The live campaign began August 31. GreyNoise's timeline: under four hours from an empty workspace to first remote code execution against a victim, a first domain admin two hours after that, and, once the full campaign launched, at least 11 organizations compromised in 26 seconds. Domain admin took as little as five minutes and never longer than 144 minutes. Per GreyNoise, credentials were harvested from 280 of the victim organizations, and operating-system or domain secrets from 147.

What the attribution rests on

The Russian-speaking attribution comes from a hardcoded, 28-country exclusion list in the attacker's tooling, led by Russia and Belarus. Criminal and state-linked malware commonly carries such lists to avoid domestic targets, so it is an indicator and does not confirm identity.

GreyNoise's own takeaway: "AI enables fast and efficient complex orchestration of cyber operations." PaperCut NG/MF's flaws were already known. What changed is tempo: agentic tooling ran the exploitation, credential harvesting, and lateral movement in parallel across hundreds of targets at once. For defenders, an unpatched known flaw on an internet-facing server is now an hours-scale exposure.