AlienVault OTX pulse data confirms an active intrusion campaign against internet-facing PaperCut MF print management servers, culminating in the deployment of the AdaptixC2 post-exploitation framework. On August 31, 2026, unknown threat actors chained two zero-day vulnerabilities — CVE-2026-82078 and CVE-2026-81578 — against a vulnerable PaperCut MF version 24.0.2 instance operated by an Education-sector organization. Two additional CVEs surfaced in the indicator set (CVE-2026-88771, CVE-2026-88772), suggesting the actor is burning or stockpiling multiple PaperCut attack surface entries in parallel.
The attack chain is methodical and consistent with modern initial-access tradecraft: exploit an edge appliance → execute an in-memory Java loader → establish a web shell for durable interactive access → deliver a trojanized Microsoft Copilot binary as a socially-engineered payload container → stage AdaptixC2 for command-and-control, credential dumping, and lateral movement. The use of a trojanized first-party Microsoft binary is a deliberate evasion choice: it blends into environments where Copilot deployment is expected, defeating naive allowlists and reputation-based filtering.
The objective appears to be persistent foothold establishment with domain compromise — the pulse tags explicitly reference domain compromise, credential dumping, and lateral movement. Education-sector print servers are attractive targets: they are internet-exposed by design (mobile printing), historically under-patched, run with elevated privileges, and sit on flat networks adjacent to domain infrastructure. PaperCut has been repeatedly abused by ransomware affiliates and state-aligned actors (the 2023 CVE-2023-27350 wave being the canonical precedent); this 2026 activity indicates adversaries have returned to the same well with fresh zero-days.
Threat Actor / Malware Profile
Attribution: Unknown. TLP:WHITE pulse authored by AlienVault, sourced from eSentire incident response telemetry. The tooling overlap (AdaptixC2, Java loaders, web shells) is consistent with both ransomware initial-access brokers and mid-sophistication APT operators; the Education targeting and print-server vector lean toward access-broker monetization, but defenders should not rule out espionage staging.
AdaptixC2 is an extensible post-exploitation framework in the Cobalt Strike mold, providing beaconing, SOCKS tunneling, credential harvesting, and lateral movement primitives. Its open availability makes it a favorite of actors seeking capability without the licensing telemetry of commercial frameworks.
- Distribution method: Exploitation of PaperCut MF 24.0.2 via CVE-2026-82078 / CVE-2026-81578 on internet-facing servers. No phishing required — this is pure edge exploitation.
- Payload behavior: An in-memory Java loader executes within the PaperCut application server's JVM context, avoiding on-disk payloads entirely. The loader deploys a web shell into the PaperCut web root, giving the actor persistent interactive command execution over HTTPS through the legitimate web application.
- Masquerading: A trojanized Microsoft Copilot binary serves as the AdaptixC2 carrier — signed-looking naming and iconography designed to survive cursory triage and blend with legitimate AI-assistant rollouts.
- C2 communication: AdaptixC2 beacons over HTTP/HTTPS with configurable malleable profiles; expect beaconing to attacker infrastructure with periodic jitter, potentially fronted through legitimate cloud CDNs.
- Persistence: The web shell provides the primary durable mechanism (it survives reboots as long as the PaperCut web application restarts). Secondary persistence typically follows via scheduled tasks or service creation once credentials are dumped.
- Anti-analysis: In-memory Java execution leaves minimal disk artifacts; the loader lives and dies in JVM memory. The trojanized Copilot binary defeats filename-based and visual detection, and AdaptixC2 supports sleep/jitter obfuscation to blend into background HTTPS noise.
IOC Analysis
The pulse carries 20 indicators across two types:
- CVEs (4): CVE-2026-82078, CVE-2026-81578 (confirmed exploited in this intrusion), plus CVE-2026-88771 and CVE-2026-88772. The CVEs are not blockable indicators — they are patch-management and exposure-hunting pivots. Every PaperCut MF instance at or below version 24.0.2 in your environment (and your vendors'/students' environments) is presumed targeted.
- FileHash-SHA256 (4+): Hashes covering the Java loader artifacts, web shell, and trojanized Copilot/AdaptixC2 payloads. These are high-fidelity, low-false-positive blockers suitable for EDR blocklists, proxy download denial, and retroactive file-integrity sweeps.
Operationalization guidance:
- Push the SHA256 set into your EDR's custom indicator/blocklist module (Defender: Custom Indicators; CrowdStrike: Custom IOCs; SentinelOne: Blacklist). Hash-based blocking is cheap and deterministic — do it first.
- Retro-hunt file creation events across print infrastructure and endpoints for these hashes; an 18-month lookback is warranted given dwell-time norms in education environments.
- Pivot the CVEs into your vulnerability scanner and attack surface management tooling (Tenable, Qualys, Defender External ASM, Shodan/Censys subscriptions) to enumerate every internet-exposed PaperCut instance org-wide — including forgotten departmental deployments.
- Detonate or query the hashes in VirusTotal, Hybrid Analysis, or MalwareBazaar to extract embedded C2 domains/IPs not present in the pulse, then block those at the egress proxy and DNS layer.
- Tooling for decoding: PEStudio / Detect It Easy for the trojanized binary, JD-GUI / Bytecode Viewer for Java loader JAR artifacts recovered from memory dumps, and Wireshark/Zeek with JA3/JA4 fingerprinting for AdaptixC2 beacon profiling.
Detection Engineering
The following analytics target the specific behaviors in this pulse: PaperCut-spawned child processes, in-memory Java loader execution, web shell deployment, and the trojanized Copilot binary masquerade.
YAML
---
title: PaperCut MF Process Spawning Suspicious Child Processes - Zero-Day Exploitation
id: 7c3a1f2e-9b4d-4e1a-a5c6-202611020001
status: experimental
description: Detects the PaperCut MF application server process spawning command interpreters, scripting engines, or binaries outside its normal operational profile — consistent with CVE-2026-82078 / CVE-2026-81578 exploitation and web shell command execution.
author: Security Arsenal Threat Intelligence
date: 2026/11/02
references:
- https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578
tags:
- attack.initial_access
- attack.t1190
- attack.t1505.003
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\pc-app.exe'
- '\java.exe'
ParentCommandLine|contains:
- 'papercut'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\mshta.exe'
- '\wmic.exe'
- '\net.exe'
- '\nltest.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare PaperCut administrative scripts invoked from the management console
level: high
---
title: Trojanized Microsoft Copilot Binary Executed From Anomalous Path
id: 7c3a1f2e-9b4d-4e1a-a5c6-202611020002
status: experimental
description: Detects execution of binaries masquerading as Microsoft Copilot from non-standard installation paths, matching the trojanized Copilot binary used to deliver AdaptixC2 in the PaperCut MF intrusion.
author: Security Arsenal Threat Intelligence
date: 2026/11/02
references:
- https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578
tags:
- attack.defense_evasion
- attack.t1036.005
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_name:
Image|contains: 'copilot'
filter_legit_paths:
Image|startswith:
- 'C:\Program Files\WindowsApps\'
- 'C:\Program Files\Microsoft\'
- 'C:\Users\'
filter_legit_users_subpath:
Image|contains:
- '\AppData\Local\Microsoft\WindowsApps\'
- '\AppData\Local\Packages\Microsoft.'
condition: selection_name and not 1 of filter_legit_*
falsepositives:
- Developer builds or renamed Copilot-adjacent utilities
level: high
---
title: AdaptixC2 Beacon Outbound HTTPS From Server Processes
id: 7c3a1f2e-9b4d-4e1a-a5c6-202611020003
status: experimental
description: Detects outbound HTTPS connections initiated by processes running on print/application servers that rarely initiate internet traffic — consistent with AdaptixC2 beaconing following PaperCut MF compromise.
author: Security Arsenal Threat Intelligence
date: 2026/11/02
references:
- https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578
tags:
- attack.command_and_control
- attack.t1071.001
- attack.t1572
logsource:
category: network_connection
product: windows
detection:
selection_proc:
Image|endswith:
- '\pc-app.exe'
- '\java.exe'
- '\w3wp.exe'
- '\copilot.exe'
selection_net:
DestinationPort:
- 443
- 8443
- 8080
Initiated: 'true'
filter_vendor:
DestinationHostname|contains:
- '.papercut.com'
- '.microsoft.com'
- '.windows.net'
- '.digicert.com'
condition: selection_proc and selection_net and not filter_vendor
falsepositives:
- PaperCut license telemetry and update checks to vendor infrastructure (filtered)
level: medium
KQL — Microsoft Sentinel / Defender
// PaperCut MF Zero-Day & AdaptixC2 Hunt — Microsoft Sentinel
// Hunts: PaperCut-spawned shells, trojanized Copilot execution, web shell file drops, and IOC hash matches
let Lookback = 30d;
let IOCHashes = dynamic(["d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222","cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2c","bc5fd75b307c2a11a602fbedb8275e0836ddf81cdd43af00a6bf0d850ff6cf58","33d0a8294d2520608dbc4901c3ebd525aaeb7b8eceba9d140f62efa419a8c55a"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","certutil.exe","mshta.exe","wmic.exe","net.exe","nltest.exe","bitsadmin.exe"]);
union isfuzzy=true
// Leg 1: PaperCut spawning suspicious child processes
(DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ ("pc-app.exe","java.exe")
or InitiatingProcessCommandLine has_any ("papercut","pc-app")
| where FileName in~ (SuspiciousChildren)
| extend HuntReason = "PaperCut spawned suspicious child process"),
// Leg 2: Trojanized Copilot binary from anomalous path
(DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName has "copilot"
| where not(FolderPath has_any ("WindowsApps","Program Files\\Microsoft","Packages\\Microsoft."))
| extend HuntReason = "Copilot binary from anomalous path"),
// Leg 3: Web shell file drops into PaperCut web directories
(DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FolderPath has_any ("papercut","PaperCut MF")
| where FileName endswith_any (".jsp",".jspx",".aspx",".php",".war")
| where ActionType == "FileCreated"
| extend HuntReason = "Possible web shell dropped into PaperCut web root"),
// Leg 4: Known pulse IOC hash matches
(DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where SHA256 in (IOCHashes)
| extend HuntReason = "Known PaperCut intrusion IOC hash match"),
// Leg 5: AdaptixC2-style outbound beaconing from server processes
(DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ ("pc-app.exe","java.exe","copilot.exe","w3wp.exe")
| where RemotePort in (443, 8443, 8080)
| where not(RemoteUrl has_any ("papercut.com","microsoft.com","windows.net","digicert.com"))
| extend HuntReason = "Outbound C2-style connection from server process")
| project TimeGenerated, HuntReason, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, SHA256, ActionType
| order by TimeGenerated desc
PowerShell
# PaperCut MF Zero-Day / AdaptixC2 IOC Hunt — Security Arsenal
# Run elevated on print servers and endpoints. Checks hashes, web shell drops,
# trojanized Copilot binaries, persistence artifacts, and live C2 connections.
$IOCHashes = @(
"d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222",
"cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2c",
"bc5fd75b307c2a11a602fbedb8275e0836ddf81cdd43af00a6bf0d850ff6cf58",
"33d0a8294d2520608dbc4901c3ebd525aaeb7b8eceba9d140f62efa419a8c55a"
)
$Findings = @()
Write-Host "[*] 1/5 Hash sweep of PaperCut and common staging directories..." -ForegroundColor Cyan
$ScanPaths = @("C:\Program Files\PaperCut MF", "$env:TEMP", "C:\Windows\Temp", "C:\ProgramData", "$env:PUBLIC")
foreach ($p in $ScanPaths) {
if (Test-Path $p) {
Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
try {
$h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
if ($IOCHashes -contains $h) {
$Findings += [PSCustomObject]@{Type="IOC_HASH_MATCH"; Path=$_.FullName; Detail=$h}
}
} catch {}
}
}
}
Write-Host "[*] 2/5 Web shell artifact hunt in PaperCut web roots..." -ForegroundColor Cyan
$WebRoots = Get-ChildItem "C:\Program Files\PaperCut MF\server" -Recurse -Include *.jsp,*.jspx,*.aspx,*.war -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-120) }
foreach ($f in $WebRoots) {
$content = Get-Content $f.FullName -Raw -ErrorAction SilentlyContinue
if ($content -match "Runtime\.getRuntime|ProcessBuilder|cmd\.exe|/bin/sh|request\.getParameter") {
$Findings += [PSCustomObject]@{Type="SUSPICIOUS_WEB_SHELL"; Path=$f.FullName; Detail="Code-exec patterns; modified $($f.LastWriteTime)"}
}
}
Write-Host "[*] 3/5 Trojanized Copilot binary check (anomalous paths)..." -ForegroundColor Cyan
Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "copilot" } | ForEach-Object {
if ($_.ExecutablePath -notmatch "WindowsApps|Program Files\\Microsoft|Packages\\Microsoft\.") {
$Findings += [PSCustomObject]@{Type="TROJAN_COPILOT_RUNNING"; Path=$_.ExecutablePath; Detail="PID $($_.ProcessId)"}
}
}
Get-ChildItem -Path "C:\Users","C:\ProgramData","C:\Windows\Temp" -Recurse -Filter "*copilot*.exe" -ErrorAction SilentlyContinue | ForEach-Object {
if ($_.FullName -notmatch "WindowsApps|Packages\\Microsoft\.") {
$Findings += [PSCustomObject]@{Type="TROJAN_COPILOT_ON_DISK"; Path=$_.FullName; Detail="Anomalous install path"}
}
}
Write-Host "[*] 4/5 Persistence artifacts (run keys, services, scheduled tasks)..." -ForegroundColor Cyan
$RunKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $RunKeys) {
Get-ItemProperty $k -ErrorAction SilentlyContinue | ForEach-Object {
$_.PSObject.Properties | Where-Object { $_.Value -match "copilot|papercut|java.*-jar|Temp|ProgramData" } | ForEach-Object {
$Findings += [PSCustomObject]@{Type="PERSISTENCE_RUNKEY"; Path="$k\$($_.Name)"; Detail=$_.Value}
}
}
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Actions.Execute -match "copilot|java.*-jar|Temp\\|ProgramData\\" } | ForEach-Object {
$Findings += [PSCustomObject]@{Type="PERSISTENCE_TASK"; Path=$_.TaskName; Detail=$_.Actions.Execute}
}
Write-Host "[*] 5/5 Live C2-style connections from server processes..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
Where-Object { $_.RemotePort -in 443,8443,8080 } | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
if ($proc.Name -match "^(pc-app|java|copilot|w3wp)$") {
$Findings += [PSCustomObject]@{Type="POSSIBLE_C2"; Path=$proc.Path; Detail="$($proc.Name) -> $($_.RemoteAddress):$($_.RemotePort)"}
}
}
Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($Findings.Count -gt 0) { $Findings | Format-Table -AutoSize; $Findings | Export-Csv "PaperCut_AdaptixC2_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation }
else { Write-Host "No indicators found. Continue monitoring and verify PaperCut MF version > 24.0.2." -ForegroundColor Green }
Response Priorities
Immediate (0–4 hours)
- Patch or isolate every PaperCut MF instance at version 24.0.2 or earlier. If a vendor fix for CVE-2026-82078 / CVE-2026-81578 is not yet deployed in your environment, remove the server from internet exposure (VPN-gate or ACL to trusted ranges) immediately — these are actively exploited zero-days.
- Push the four SHA256 indicators to EDR blocklists and proxy download filters; trigger retroactive file scans org-wide.
- Deploy the Sigma rules and run the KQL hunt across the last 30 days of telemetry on all print/application servers.
- Pull web server access logs for PaperCut instances; look for anomalous POST requests to JSP endpoints and scanner-like probing preceding August 31, 2026.
24 Hours
- Treat credentials as compromised on any affected host. PaperCut MF servers commonly hold service accounts with broad read access; force resets for any account that authenticated to or from the print server, prioritizing domain-joined service accounts.
- Hunt for credential dumping artifacts (lsass access by non-system processes, ntds.dit staging, procdump/comsvcs.dll MiniDump usage) on the print server and its immediate network neighbors.
- Review lateral movement: SMB/RDP/WinRM connections originating FROM the print server in the intrusion window are top-suspicion events — print servers have almost no legitimate reason to initiate admin protocol connections to workstations or DCs.
- Memory-capture any live PaperCut server before reboot: the in-memory Java loader evaporates on restart.
1 Week
- Architectural hardening: print management infrastructure should never be directly internet-facing. Move PaperCut behind authenticated reverse proxies or Zero Trust access brokers; enforce mTLS or IP allowlisting for mobile printing flows.
- Segment print servers into a dedicated VLAN with egress filtering — deny outbound 443 except to an explicit vendor allowlist (this single control would have severed the AdaptixC2 channel).
- Deploy application control (WDAC/AppLocker) on print servers to block unauthorized child process execution from the PaperCut JVM.
- Establish JVM monitoring: enable Java agent-based telemetry or EDR AMSI-equivalent hooks on Tomcat/Java application servers to catch in-memory loader classes.
- Subscribe to OTX pulse feeds for PaperCut and AdaptixC2 tags; the appearance of CVE-2026-88771/88772 in this pulse signals follow-on exploitation is likely imminent.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.