AI-Orchestrated PaperCut & Spring Batch Exploitation: OTX Pulse Analysis — Enterprise Detection Pack for CVE-2026-81578, CVE-2026-82078 & Cairn Agent Attacks

---
title: Chisel Reverse SOCKS5 Tunnel Execution
id: 7c3a9e21-4f2b-4d8a-9c1e-5a6b7c8d9e0f
status: experimental
description: Detects execution of the Chisel tunneling binary or command-line patterns consistent with reverse SOCKS5 tunnel establishment, as observed in the AI-orchestrated PaperCut campaign (OTX 2026-11-14).
author: Security Arsenal Threat Intelligence
references:
    - https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce
date: 2026/11/14
tags:
    - attack.command_and_control
    - attack.t1090
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\chisel.exe'
            - '\chisel64.exe'
    selection_cli:
        CommandLine|contains:
            - ' client '
            - ' server '
        CommandLine|contains|all:
            - 'R:socks'
            - '--reverse'
    selection_socks:
        CommandLine|contains:
            - 'socks5'
            - '--socks5'
    condition: selection_img or (selection_cli and selection_socks)
falsepositives:
    - Legitimate red team or penetration testing activity
level: high
---
title: PaperCut or Tomcat Process Spawning Shell or Scripting Child
id: 9d4b8f32-5e3c-4a1b-8d2f-6b7c8d9e0f1a
status: experimental
description: Detects PaperCut NG/MF (pc-app.exe, java.exe under PaperCut path) or Apache Tomcat processes spawning command shells, PowerShell, or scripting interpreters - consistent with CVE-2026-81578/CVE-2026-82078 exploitation and Spring Batch job-submission RCE.
author: Security Arsenal Threat Intelligence
references:
    - https://reliaquest.com/blog/threat-spotlight-how-ai-agents-turned-one-exposed-endpoint-into-a-server-takeover
date: 2026/11/14
tags:
    - attack.execution
    - attack.t1059
    - attack.t1190
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\pc-app.exe'
            - '\tomcat9.exe'
            - '\tomcat8.exe'
            - '\tomcat.exe'
        ParentImage|contains:
            - '\PaperCut MF\'
            - '\PaperCut NG\'
            - '\Tomcat\'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\nltest.exe'
            - '\quser.exe'
    condition: selection_parent and selection_child
falsepositives:
    - PaperCut print scripting features invoking cmd.exe legitimately - baseline per environment
    - Tomcat applications with legitimate system command execution
level: high
---
title: OTX PaperCut AI Campaign IOC File Hash Execution
id: 1e5c9a43-6f4d-4b2c-9e3a-7c8d9e0f1a2b
status: experimental
description: Detects execution of files matching known IOC hashes from the exposed AI-orchestrated PaperCut attacker workbench at 45.142.193.132.
author: Security Arsenal Threat Intelligence
references:
    - https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce
date: 2026/11/14
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_sha256:
        Hashes|contains:
            - 'SHA256=c3f7109963b9599eb93fd9a97a4ffa38e672642b35b33608d69e6bbf9f19da4e'
            - 'SHA256=14779d0d7ad6be3d7bf9ed78e4ab6016f22dfa7bc8b5d9c43b56011f7fe2ea19'
    selection_md5:
        Hashes|contains:
            - 'MD5=528cd4e69ecfa5191adbcf6ef28667bf'
            - 'MD5=a6437ac3d6798090a218520985d36a3f'
            - 'MD5=ce870a91e8d27e8f663f0687abc60b04'
            - 'MD5=fc92dfafa7aa741c5f2b9cbcf75d1d19'
    condition: selection_sha256 or selection_md5
falsepositives:
    - None expected - these are attacker workbench artifacts
level: critical

// Hunt: AI-orchestrated PaperCut / Spring Batch exploitation indicators
// Covers C2 to workbench IP, suspicious child processes of print/Tomcat services,
// credential access behavior, and outbound tunneling patterns.
let IOC_IPs = dynamic(["45.142.193.132"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","whoami.exe","net.exe","nltest.exe","certutil.exe","bitsadmin.exe","rundll32.exe","chisel.exe"]);
let SuspiciousParents = dynamic(["pc-app.exe","tomcat.exe","tomcat8.exe","tomcat9.exe","javaw.exe","java.exe"]);
union isfuzzy=true
// Network connections to known workbench/C2 IP
(DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteIP in (IOC_IPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType),
// Suspicious child processes spawned by PaperCut/Tomcat/Java service processes
(DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ (SuspiciousParents)
    or InitiatingProcessFolderPath has_any ("PaperCut", "Tomcat")
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SHA256),
// Chisel-style long-lived outbound sessions on unusual ports from servers
(DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (SuspiciousParents)
| where RemoteIPType == "Public" and RemotePort !in (80, 443, 25, 53, 389, 636, 9100)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort),
// Spring Batch / Tomcat java.exe spawning shells (Linux + Windows coverage)
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "java.exe" or InitiatingProcessFileName =~ "java"
| where FileName in~ ("cmd.exe","powershell.exe","sh","bash","dash") 
| where InitiatingProcessCommandLine has_any ("catalina", "spring", "batch", "tomcat")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName)

# Security Arsenal - PaperCut / Cairn AI Campaign IOC Hunt Script
# Run elevated on print servers, Tomcat hosts, and domain-joined servers.
# Outputs findings to C:\Temp\PaperCut_Hunt_<hostname>_<date>.log

$ErrorActionPreference = 'SilentlyContinue'
$log = "C:\Temp\PaperCut_Hunt_$($env:COMPUTERNAME)_$(Get-Date -Format yyyyMMdd_HHmmss).log"
New-Item -Path C:\Temp -ItemType Directory -Force | Out-Null
function Write-Finding($msg) { $line = "$(Get-Date -Format o) $msg"; Add-Content -Path $log -Value $line; Write-Host $line -ForegroundColor Yellow }

Write-Finding "=== HUNT START: AI-Orchestrated PaperCut/Spring Batch Campaign ==="

# 1. IOC file hash sweep (SHA256 + MD5) across common staging paths
$targetHashes = @(
    'c3f7109963b9599eb93fd9a97a4ffa38e672642b35b33608d69e6bbf9f19da4e',
    '14779d0d7ad6be3d7bf9ed78e4ab6016f22dfa7bc8b5d9c43b56011f7fe2ea19',
    '528cd4e69ecfa5191adbcf6ef28667bf',
    'a6437ac3d6798090a218520985d36a3f',
    'ce870a91e8d27e8f663f0687abc60b04',
    'fc92dfafa7aa741c5f2b9cbcf75d1d19'
)
$scanPaths = @('C:\Windows\Temp','C:\ProgramData','C:\Users\Public','C:\Program Files\PaperCut*','C:\Program Files\Apache*','C:\Temp')
foreach ($p in $scanPaths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        try {
            $h256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            $hmd5 = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
            if ($targetHashes -contains $h256 -or $targetHashes -contains $hmd5) {
                Write-Finding "[CRITICAL] IOC hash match: $($_.FullName) SHA256=$h256 MD5=$hmd5"
            }
        } catch {}
    }
}

# 2. Chisel binary and reverse SOCKS5 artifacts
Get-ChildItem -Path 'C:\','D:\' -Recurse -Include 'chisel*.exe' -File -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Finding "[HIGH] Chisel binary found: $($_.FullName)"
}
Get-Process | Where-Object { $_.ProcessName -match 'chisel' } | ForEach-Object {
    Write-Finding "[CRITICAL] Running chisel process: PID $($_.Id) Path $($_.Path)"
}

# 3. Network connections to workbench IP and suspicious outbound from service processes
Get-NetTCPConnection -State Established | Where-Object { $_.RemoteAddress -eq '45.142.193.132' } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    Write-Finding "[CRITICAL] Active connection to C2 45.142.193.132 :$($_.RemotePort) by $($proc.ProcessName) (PID $($_.Id))"
}
Get-NetTCPConnection -State Established | Where-Object {
    $_.RemotePort -notin @(80,443,25,53,389,636,9100,3389) -and $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|169\.254\.)'
} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    if ($proc.ProcessName -match 'pc-app|tomcat|java|chisel') {
        Write-Finding "[HIGH] Service process outbound on unusual port: $($proc.ProcessName) -> $($_.RemoteAddress):$($_.RemotePort)"
    }
}

# 4. PaperCut service account / suspicious services and scheduled tasks (persistence)
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'chisel|socks|papercut.*cmd|temp.*\.exe' } | ForEach-Object {
    Write-Finding "[HIGH] Suspicious service: $($_.Name) -> $($_.PathName)"
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'chisel|powershell.*-enc|cmd.*/c.*temp' } | ForEach-Object {
    Write-Finding "[HIGH] Suspicious scheduled task: $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)"
}

# 5. Registry run-key persistence referencing tunneling or temp binaries
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($k in $runKeys) {
    (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match 'chisel|\\temp\\|\\programdata\\.*\.exe' } | ForEach-Object {
        Write-Finding "[HIGH] Suspicious autorun entry in $k : $($_.Name) = $($_.Value)"
    }
}

# 6. Credential access artifacts: recent LSASS access + PaperCut credential store tampering
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656} -MaxEvents 5000 | Where-Object { $_.Message -match 'lsass.exe' -and $_.Message -notmatch 'MsMpEng|svchost|wininit|csrss' } | Select-Object -First 10 | ForEach-Object {
    Write-Finding "[MEDIUM] Possible LSASS handle access - review Event: $($_.TimeCreated)"
}

# 7. PaperCut / Tomcat version inventory for CVE-2026-81578 / CVE-2026-82078 exposure
Get-CimInstance Win32_Product | Where-Object { $_.Name -match 'PaperCut|Tomcat' } | ForEach-Object {
    Write-Finding "[INFO] Installed: $($_.Name) v$($_.Version) - validate against vendor CVE-2026-81578/82078 advisory"
}

Write-Finding "=== HUNT COMPLETE ==="
Write-Host "`nResults written to $log" -ForegroundColor Cyan