CVE-2026-81578 & CVE-2026-82078: PaperCut Exploitation in Education Sector Attacks — Detection and Remediation Guide

---
title: PaperCut Application Server Spawning Shell or Script Interpreter
id: 3f8c2a71-9b4d-4e5a-a1c6-7d8e9f0a1b2c
status: experimental
description: Detects the PaperCut Application Server (pc-app.exe or its Java runtime) spawning command shells, PowerShell, or scripting interpreters — a strong post-exploitation indicator for CVE-2026-81578 / CVE-2026-82078 abuse.
references:
  - https://securityaffairs.com/198476/hacking/papercut-flaws-exploited-in-attacks-on-u-s-and-european-schools.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/03/09
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\java.exe'
      - '\javaw.exe'
    ParentCommandLine|contains:
      - 'papercut'
      - 'PaperCut MF'
      - 'PaperCut NG'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; PaperCut print scripting can invoke external commands in custom deployments — baseline per environment
level: high
---
title: Credential Access Artifacts on PaperCut Server Host
id: 8a1d4e62-3c5f-4b7a-9d2e-5f6a7b8c9d0e
status: experimental
description: Detects access to LSASS memory or credential stores on hosts running the PaperCut Application Server, consistent with the credential-theft objectives reported in the CVE-2026-81578 campaign.
references:
  - https://securityaffairs.com/198476/hacking/papercut-flaws-exploited-in-attacks-on-u-s-and-european-schools.html
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/03/09
tags:
  - attack.credential_access
  - attack.t1003.001
  - attack.t1552
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1fffff'
  filter_legitimate:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\svchost.exe'
      - '\wininit.exe'
      - '\csrss.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Backup agents and some EDR components access LSASS; tune SourceImage exclusions for your stack
level: high
---
title: Suspicious File Write to PaperCut Server Directories
id: 5b7e9c14-2d6a-4f8b-a3e1-9c0d1e2f3a4b
status: experimental
description: Detects executable or script files written into PaperCut installation and web directories, consistent with webshell or tooling deployment following exploitation of PaperCut application flaws.
references:
  - https://securityaffairs.com/198476/hacking/papercut-flaws-exploited-in-attacks-on-u-s-and-european-schools.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/03/09
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\PaperCut MF\'
      - '\PaperCut NG\'
      - '\papercut\server\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.cmd'
      - '.war'
  filter_updates:
    Image|endswith:
      - '\pc-app.exe'
      - '\pc-update.exe'
      - '\msiexec.exe'
  condition: selection_path and selection_ext and not filter_updates
falsepositives:
  - Legitimate PaperCut upgrades and hotfix installations; correlate against change windows
level: medium

// Hunt 1: PaperCut server process spawning suspicious child processes
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("pc-app.exe", "java.exe", "javaw.exe")
   or InitiatingProcessCommandLine has_any ("papercut", "PaperCut MF", "PaperCut NG")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
    "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe",
    "wmic.exe", "net.exe", "net1.exe", "whoami.exe", "nltest.exe", "ipconfig.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc;

// Hunt 2: PaperCut service account used from anomalous source (credential theft follow-through)
SigninLogs
| where TimeGenerated > ago(14d)
| where UserPrincipalName has_any ("papercut", "svc-print", "svc_print", "pc-service")
| summarize SigninCount = count(), SourceIPs = make_set(IPAddress),
    Locations = make_set(Location), Apps = make_set(AppDisplayName)
    by UserPrincipalName, bin(TimeGenerated, 1h)
| where SigninCount > 5 or array_length(SourceIPs) > 2;

// Hunt 3: New local admin or service accounts created on print servers
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "net.exe" or FileName =~ "net1.exe"
| where ProcessCommandLine has_any ("localgroup administrators", "user /add", "user /domain /add")
| join kind=inner (
    DeviceInfo
    | where DeviceName has_any ("print", "papercut", "pc-app")
    | project DeviceName
) on DeviceName
| project TimeGenerated, DeviceName, ProcessCommandLine, AccountName, InitiatingProcessFileName;

// Hunt 4: Outbound connections from PaperCut server process to rare destinations
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("pc-app.exe", "java.exe", "javaw.exe")
   or InitiatingProcessCommandLine has "papercut"
| where RemoteIPType == "Public"
| where RemotePort !in (443, 80, 9191, 9192, 9193)
| summarize ConnectionCount = count(), Ports = make_set(RemotePort),
    IPs = make_set(RemoteIP) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1d)
| order by ConnectionCount desc;

-- Hunt for PaperCut Application Server processes with suspicious children
-- and review PaperCut service account context across the fleet
LET children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)cmd\.exe|powershell|wscript|cscript|mshta|certutil|bitsadmin|net(1)?\.exe'

LET parents = SELECT Pid, Name, CommandLine
FROM pslist()
WHERE CommandLine =~ '(?i)papercut'
   OR Name =~ '(?i)pc-app|javaw?'

SELECT c.Pid AS ChildPid, c.Name AS ChildName, c.CommandLine AS ChildCmd,
       c.Username AS RunAs, c.CreateTime AS Started,
       p.Name AS ParentName, p.CommandLine AS ParentCmd
FROM children AS c
JOIN parents AS p ON c.Ppid = p.Pid

# PaperCut CVE-2026-81578 / CVE-2026-82078 — Exposure & Compromise Verification
# Run elevated on the PaperCut Application Server host.

# 1. Identify installed PaperCut version — compare against vendor advisory for fixed builds
$pcPaths = @("$env:ProgramFiles\PaperCut MF", "$env:ProgramFiles\PaperCut NG",
             "${env:ProgramFiles(x86)}\PaperCut MF", "${env:ProgramFiles(x86)}\PaperCut NG")
foreach ($p in $pcPaths) {
    if (Test-Path $p) {
        Write-Host "[+] PaperCut installation found: $p"
        Get-ChildItem $p -Recurse -Include "pc-app.exe","version.txt","ReleaseNotes*" -ErrorAction SilentlyContinue |
            Select-Object FullName, @{N='FileVersion';E={$_.VersionInfo.FileVersion}}, LastWriteTime
    }
}

# 2. Check whether the PaperCut web interface is exposed beyond management segment
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 9191,9192,9193 } |
    Select-Object LocalAddress, LocalPort, OwningProcess,
        @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

# 3. Hunt for suspicious child processes of the PaperCut service in recent event logs
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'pc-app\.exe|javaw?\.exe' -and
                   $_.Message -match 'cmd\.exe|powershell|wscript|cscript|mshta|certutil|net\.exe|net1\.exe' } |
    Select-Object TimeCreated, Message | Format-List

# 4. Review recent local account creation and admin group changes
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720,4728,4732,4756; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Id, Message | Format-List

# 5. Sweep PaperCut directories for recently dropped executables/scripts (potential webshells/tooling)
foreach ($p in $pcPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -Include *.jsp,*.jspx,*.exe,*.ps1,*.bat,*.cmd,*.dll -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
            Select-Object FullName, LastWriteTime, Length
    }
}

# 6. Inventory PaperCut service account — verify it is gMSA or least-privilege, NOT Domain Admin
Get-CimInstance Win32_Service -Filter "Name LIKE '%papercut%' OR DisplayName LIKE '%PaperCut%'" |
    Select-Object Name, DisplayName, StartName, State, PathName