Threat Summary
AlienVault OTX pulse data confirms an active intrusion campaign exploiting two zero-day vulnerabilities in PaperCut MF (CVE-2026-82078 and CVE-2026-81578) against internet-facing print management servers. The confirmed victimology to date centers on the Education sector, where PaperCut MF is ubiquitous for campus print management — a position that makes these servers high-value, often under-monitored, perimeter assets.
On August 31, 2026, threat actors targeted a vulnerable PaperCut MF version 24.0.2 server exposed to the internet. The attack chain observed by researchers proceeds as follows:
- Initial Access (T1190 — Exploit Public-Facing Application): Weaponization of CVE-2026-82078 and CVE-2026-81578 against the PaperCut MF application server.
- In-Memory Java Loader: A fileless Java-based loader executes within the PaperCut JVM process, minimizing on-disk artifacts.
- Web Shell Establishment: The loader deploys a web shell into the PaperCut webroot, giving attackers persistent HTTP-based remote command execution.
- C2 Implant Delivery: Through the web shell, a trojanized Microsoft Copilot binary is staged — a legitimate-looking signed application abused as a delivery vehicle for the AdaptixC2 beacon.
- Post-Exploitation: Credential dumping and lateral movement toward full domain compromise.
The operator's objective is clear from the tooling and behavior: domain-level compromise. AdaptixC2 is a full-featured post-exploitation framework, and the observed credential dumping indicates the actors are harvesting authentication material for privilege escalation and lateral movement — not opportunistic smash-and-grab theft. Two additional CVEs (CVE-2026-88771, CVE-2026-88772) appear in the indicator set and likely represent related or chained vulnerability disclosures in the same product surface.
This mirrors the 2023 exploitation wave against PaperCut MF/NG (CVE-2023-27350) by Cl0p, LockBit, and state-aligned actors — print servers remain a soft, high-privilege entry point into enterprise networks.
Threat Actor / Malware Profile
Attribution: The pulse lists the adversary as Unknown. The tradecraft — zero-day exploitation of edge software, in-memory loading, living-off-the-land binary abuse, and AdaptixC2 — is consistent with both initial access brokers (IABs) preparing access for ransomware affiliates and APT-style intrusions. Treat as an organized, resourced actor.
AdaptixC2 is an open-source post-exploitation / C2 framework that has seen rapid adoption by threat actors following the crackdown and fragmentation around Cobalt Strike and the decline of Brute Ratel availability. Key characteristics relevant to this campaign:
- Distribution method: Delivered via trojanized Microsoft Copilot binary (side-loading or repackaged installer), staged through an attacker-controlled web shell on the compromised PaperCut server.
- Payload behavior: In-memory beacon execution with configurable sleep/jitter; supports credential dumping (LSASS access, SAM/SECURITY hive extraction), token manipulation, lateral movement via SMB/WMI/WinRM, and SOCKS proxying.
- C2 communication: HTTP/HTTPS beacons with malleable profiles designed to blend with legitimate traffic; the Copilot trojanization suggests the operator is deliberately masquerading traffic and binaries as Microsoft AI-assistant telemetry/processes.
- Persistence: Web shell on the PaperCut server provides resilient re-entry; on endpoints, expect service creation, scheduled tasks, or Run-key persistence under names mimicking Copilot/Windows components.
- Anti-analysis: Fileless Java loader stage (no on-disk dropper), abuse of a legitimate signed binary as the delivery vehicle, and in-memory-only payload stages designed to defeat signature-based AV and forensic disk triage.
The Java loader + web shell stage is the critical detection seam: PaperCut MF runs as a Tomcat-hosted Java application (pc-app.exe / java.exe under PAPER CUT service context), so anomalous child processes, JSP file writes, or unexpected network egress from that process tree are high-fidelity signals.
IOC Analysis
The pulse contains 20 indicators across two types:
- CVEs (4): CVE-2026-82078, CVE-2026-81578 (exploited in the wild), CVE-2026-88771, CVE-2026-88772. These are not network indicators — they are asset intelligence. Operationalize them by immediately inventorying all PaperCut MF instances, flagging version 24.0.2 and earlier as critically exposed, and driving emergency patching.
- FileHash-SHA256 (4 shown, 16 total): Hashes covering the Java loader artifacts, web shell files, and the trojanized Copilot binary / AdaptixC2 payload:
d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2cbc5fd75b307c2a11a602fbedb8275e0836ddf81cdd43af00a6bf0d850ff6cf5833d0a8294d2520608dbc4901c3ebd525aaeb7b8eceba9d140f62efa419a8c55a
Operationalization guidance for SOC teams:
- Push SHA256 hashes into your EDR blocklist / custom indicator list (Microsoft Defender for Endpoint Custom Indicators, CrowdStrike IOC Management, SentinelOne hash blocklist).
- Retro-hunt EDR telemetry for hash presence over the past 90 days — zero-days mean exposure likely predates disclosure.
- Use VirusTotal Intelligence, Hybrid Analysis, or ANY.RUN to detonate/match hashes and extract dropped C2 domains/IPs for network blocking.
- Do not rely on hashes alone: the in-memory Java loader means the most reliable detections are behavioral — PaperCut's Java process spawning shells, JSP writes to the webroot, and trojanized Copilot binaries with mismatched Authenticode signatures.
Detection Engineering
YAML
---
title: PaperCut MF Java Process Spawning Suspicious Child Processes
id: 7f1a2c3e-8b4d-4e6f-9a1c-2d5b7e8f9a0b
status: experimental
description: Detects PaperCut MF application server (Java/Tomcat process) spawning command shells, script interpreters, or system utilities - consistent with post-exploitation via CVE-2026-82078 / CVE-2026-81578 web shell activity
references:
- https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578
author: Security Arsenal Threat Intelligence
date: 2026/11/02
tags:
- attack.initial_access
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\pc-app.exe'
- '\java.exe'
- '\javaw.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\whoami.exe'
- '\net.exe'
- '\nltest.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate PaperCut administrative scripts (rare; validate against change windows)
level: high
---
title: Trojanized Microsoft Copilot Binary With Mismatched Signature or Path
id: 9c2d4e6f-1a3b-4c5d-8e7f-0a9b1c2d3e4f
status: experimental
description: Detects execution of Copilot-named binaries outside legitimate Microsoft installation paths or unsigned/invalidly signed - associated with trojanized Copilot binary delivering AdaptixC2 beacon
references:
- https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578
author: Security Arsenal Threat Intelligence
date: 2026/11/02
tags:
- attack.defense_evasion
- attack.t1036
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_name:
Image|contains:
- 'copilot'
- 'Copilot'
filter_legit_paths:
Image|startswith:
- 'C:\Program Files\WindowsApps\Microsoft.'
- 'C:\Program Files\Microsoft '
condition: selection_name and not filter_legit_paths
falsepositives:
- Developer/test builds of Copilot integrations
level: high
---
title: Web Shell JSP Write to PaperCut Webroot
id: 3b5c7d9e-2f4a-5b6c-9d8e-1f2a3b4c5d6e
status: experimental
description: Detects creation of JSP or script files in PaperCut MF web application directories - indicator of web shell deployment following zero-day exploitation
references:
- https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578
author: Security Arsenal Threat Intelligence
date: 2026/11/02
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- '\PaperCut MF\server\'
- '\papercut\server\web\'
TargetFilename|endswith:
- '.jsp'
- '.jspx'
- '.war'
condition: selection
falsepositives:
- Legitimate PaperCut updates or custom report deployments (correlate with vendor change records)
level: critical
KQL — Microsoft Sentinel / Defender
// Hunt for PaperCut MF exploitation, web shell activity, and AdaptixC2 staging
// Microsoft Sentinel / Defender XDR - 30 day retro-hunt
let PCHashes = dynamic([
"d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222",
"cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2c",
"bc5fd75b307c2a11a602fbedb8275e0836ddf81cdd43af00a6bf0d850ff6cf58",
"33d0a8294d2520608dbc4901c3ebd525aaeb7b8eceba9d140f62efa419a8c55a"
]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","certutil.exe","whoami.exe","net.exe","nltest.exe","wscript.exe","cscript.exe","bitsadmin.exe"]);
union
// 1) PaperCut Java process spawning suspicious children (web shell / loader behavior)
(DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("pc-app.exe","java.exe","javaw.exe")
or InitiatingProcessFolderPath has_any ("PaperCut","papercut")
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine, SHA256, AccountName
| extend Detection = "PaperCut child process"),
// 2) Trojanized Copilot binary execution outside legitimate paths
(DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName has "copilot" or ProcessCommandLine has "copilot"
| where not (FolderPath has_any ("WindowsApps\\Microsoft","Program Files\\Microsoft"))
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine,
SHA256, InitiatingProcessFileName, AccountName
| extend Detection = "Trojanized Copilot binary"),
// 3) Known pulse hash hits
(DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where SHA256 in~ (PCHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine,
SHA256, InitiatingProcessFileName, AccountName
| extend Detection = "Pulse IOC hash match"),
// 4) Network egress from PaperCut server process (C2 beaconing)
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("pc-app.exe","java.exe")
and InitiatingProcessFolderPath has_any ("PaperCut","papercut")
| where RemoteIPType == "Public"
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP, 20), Ports = make_set(RemotePort, 20)
by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| extend Detection = "PaperCut external egress")
| sort by TimeGenerated desc
PowerShell
#Requires -RunAsAdministrator
<#
.SYNOPSIS
PaperCut MF Zero-Day / AdaptixC2 IOC Hunt Script
.DESCRIPTION
Checks for pulse IOC hashes, suspicious files in PaperCut webroot,
trojanized Copilot binaries, and anomalous persistence artifacts.
#>
$PulseHashes = @(
"d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222",
"cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2c",
"bc5fd75b307c2a11a602fbedb8275e0836ddf81cdd43af00a6bf0d850ff6cf58",
"33d0a8294d2520608dbc4901c3ebd525aaeb7b8eceba9d140f62efa419a8c55a"
)
$Findings = @()
Write-Host "[*] === PaperCut MF / AdaptixC2 IOC Hunt ===" -ForegroundColor Cyan
# 1) Check for PaperCut installation and version
Write-Host "`n[1] Enumerating PaperCut MF installation..." -ForegroundColor Yellow
$pcPaths = @("C:\Program Files\PaperCut MF", "D:\PaperCut MF", "C:\Program Files (x86)\PaperCut MF")
foreach ($path in $pcPaths) {
if (Test-Path $path) {
Write-Host " [!] PaperCut MF found at: $path" -ForegroundColor Red
$versionFile = Get-ChildItem "$path\server\lib*" -Filter "*.jar" -ErrorAction SilentlyContinue | Select-Object -First 3
$Findings += [PSCustomObject]@{Check="PaperCut Install"; Result="FOUND: $path"; Risk="Review version vs CVE-2026-82078/81578"}
# 2) Scan webroot for suspicious/recent JSP files (web shells)
Write-Host "[2] Scanning PaperCut webroot for suspicious JSP files..." -ForegroundColor Yellow
$jspFiles = Get-ChildItem -Path $path -Recurse -Include *.jsp,*.jspx -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-120) }
foreach ($jsp in $jspFiles) {
$hash = (Get-FileHash $jsp.FullName -Algorithm SHA256).Hash.ToLower()
$isIOC = $PulseHashes -contains $hash
$flag = if ($isIOC) { "CONFIRMED IOC MATCH" } else { "Recently modified - review" }
Write-Host " [!] $($jsp.FullName) | $($jsp.LastWriteTime) | $flag" -ForegroundColor $(if($isIOC){"Red"}else{"DarkYellow"})
$Findings += [PSCustomObject]@{Check="Webroot JSP"; Result="$($jsp.FullName) [$flag]"; Risk=if($isIOC){"CRITICAL"}else{"Medium"}}
}
}
}
# 3) Hunt for trojanized Copilot binaries
Write-Host "`n[3] Hunting for Copilot binaries outside legitimate paths..." -ForegroundColor Yellow
$searchRoots = @("C:\Users", "C:\ProgramData", "C:\Windows\Temp", "$env:TEMP")
foreach ($root in $searchRoots) {
Get-ChildItem -Path $root -Recurse -Filter "*copilot*.exe" -ErrorAction SilentlyContinue | ForEach-Object {
$sig = Get-AuthenticodeSignature $_.FullName
$hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
$isIOC = $PulseHashes -contains $hash
$sigStatus = $sig.Status
Write-Host " [!] $($_.FullName) | Sig: $sigStatus | IOC: $isIOC" -ForegroundColor Red
$Findings += [PSCustomObject]@{Check="Copilot Binary"; Result="$($_.FullName) | Sig=$sigStatus"; Risk=if($isIOC){"CRITICAL - IOC MATCH"}elseif($sigStatus -ne 'Valid'){"High"}else{"Review"}}
}
}
# 4) Persistence artifacts: services, scheduled tasks, Run keys
Write-Host "`n[4] Checking persistence mechanisms..." -ForegroundColor Yellow
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match "copilot|adaptix" } | ForEach-Object {
Write-Host " [!] Suspicious service: $($_.Name) -> $($_.PathName)" -ForegroundColor Red
$Findings += [PSCustomObject]@{Check="Service"; Result="$($_.Name): $($_.PathName)"; Risk="High"}
}
Get-ScheduledTask | Where-Object { $_.TaskName -match "copilot|adaptix" -or ($_.Actions.Execute -match "copilot") } | ForEach-Object {
Write-Host " [!] Suspicious task: $($_.TaskName)" -ForegroundColor Red
$Findings += [PSCustomObject]@{Check="ScheduledTask"; Result=$_.TaskName; Risk="High"}
}
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $runKeys) {
(Get-ItemProperty $rk -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Value -match "copilot|adaptix" } | ForEach-Object {
Write-Host " [!] Run key: $rk\$($_.Name) = $($_.Value)" -ForegroundColor Red
$Findings += [PSCustomObject]@{Check="RunKey"; Result="$($_.Name) = $($_.Value)"; Risk="High"}
}
}
# 5) Active network connections from Java/PaperCut processes
Write-Host "`n[5] Checking active network connections from PaperCut/Java processes..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
if ($proc -and ($proc.Name -match "java|javaw|pc-app")) {
$isPublic = -not ($_.RemoteAddress -match "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1)")
if ($isPublic) {
Write-Host " [!] $($proc.Name) (PID $($proc.Id)) -> $($_.RemoteAddress):$($_.RemotePort)" -ForegroundColor Red
$Findings += [PSCustomObject]@{Check="Network"; Result="$($proc.Name) -> $($_.RemoteAddress):$($_.RemotePort)"; Risk="High - external egress"}
}
}
}
# Summary
Write-Host "`n[*] === HUNT SUMMARY: $($Findings.Count) findings ===" -ForegroundColor Cyan
$Findings | Format-Table -AutoSize | Out-String -Width 250 | Write-Host
$Findings | Export-Csv -Path ".\papercut_adaptixc2_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
Write-Host "[*] Results exported to CSV." -ForegroundColor Green
Response Priorities
Immediate (0–4 hours):
- Block the four confirmed SHA256 hashes (and the full 20-indicator set from the pulse) in EDR and email/web gateways.
- Inventory every PaperCut MF instance in the environment; isolate any internet-facing instance running 24.0.2 or earlier until patched.
- Run the retro-hunt KQL and PowerShell hunt on all print servers and their adjacent hosts; check webroots for unauthorized JSP files.
- Review PaperCut server egress firewall rules — these servers should have near-zero internet-initiated outbound requirements.
24 Hours:
- Given confirmed credential dumping behavior, treat any host showing exploitation indicators as having compromised credentials: force password resets for all accounts that authenticated to or from affected systems, prioritizing service accounts and domain admins.
- Invalidate Kerberos tickets (double
krbtgtreset if domain compromise is confirmed or suspected) and revoke active sessions/tokens in Entra ID / your IdP. - Audit new local/domain account creation, group membership changes, and DCSync-style replication events since August 31, 2026.
- Verify MFA enforcement on all remote access paths — harvested credentials are only useful to the actor if they can be replayed.
1 Week:
- Apply vendor patches for CVE-2026-82078, CVE-2026-81578, CVE-2026-88771, and CVE-2026-88772 across all PaperCut MF deployments; establish an emergency patch SLA for internet-facing applications.
- Remove print management servers from direct internet exposure — place behind VPN/ZTNA with application-layer filtering.
- Implement application control (WDAC/AppLocker) preventing Java processes from spawning shells and blocking unsigned binaries executing from user-writable paths (the trojanized Copilot staging vector).
- Segment print servers away from domain controllers and tier-0 assets; deploy dedicated detections for JVM-spawned child processes as a permanent analytic.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.