AlienVault OTX pulse data describes an exposed attacker workbench at 45.142.193[.]132 containing AI-agent instructions, exploit code, operational logs, and post-exploitation tooling for a campaign against PaperCut NG/MF print management software. The activity is especially relevant to education environments, where PaperCut is common and often has broad reach into user identity, print queues, service accounts, and adjacent Active Directory assets. The reported chain combines CVE-2026-81578 and CVE-2026-82078 through a Tapestry/XML-RPC abuse path, followed by development of a second RCE route, reverse SOCKS5 tunneling, Chisel persistence, credential harvesting, and Active Directory compromise. The operational objective appears to be durable access to print infrastructure, identity theft at scale, and lateral movement from an internet-facing application server into the domain.
The most important defender takeaway is not only the CVE pair, but the operator model: AI-orchestrated exploitation using a PentAGI-style workflow can compress reconnaissance, exploit adaptation, and post-exploitation into a repeatable loop. Treat exposed PaperCut servers as high-value identity gateways, not as peripheral print appliances. Validate CVE status against vendor advisories because the identifiers are recent and may be reserved, contested, or rapidly updated; still, the behaviors described are actionable regardless of final CVE naming.
Threat Actor / Malware Profile
Attribution is currently unknown, but the toolkit profile is consistent with an intrusion operator or initial access group using automation to scale exploitation. Distribution begins with internet-exposed PaperCut NG/MF servers and vulnerable Tapestry/XML-RPC components. After exploit execution, the operator deploys a second-stage payload, establishes command execution under the PaperCut service context, and tunnels traffic through reverse SOCKS5 using Chisel or a renamed equivalent. Persistence is likely achieved through Chisel as a service, scheduled task, run key, or wrapper script rather than a noisy implant. Credential theft follows through LSASS access, SAM/SECURITY/SYSTEM registry hive extraction, NTDS.dit harvesting, token theft, and reuse of print-service or domain credentials for lateral movement.
Expected C2 behavior is low-and-slow outbound TCP from the compromised server to attacker infrastructure, potentially over common ports, with SOCKS5 proxying enabling interactive operator access. Anti-analysis indicators include exposed-directory tradecraft mistakes despite otherwise mature automation, renamed binaries, AI-generated exploit variants, log deletion, timestomping, and use of legitimate admin tools such as ntdsutil, vssadmin, reg save, rundll32, PowerShell, and curl. The five published hashes should be treated as payload or tooling artifacts, while the IPv4 address is current command-and-control or staging infrastructure pending pivot validation.
IOC Analysis
The pulse contains one IPv4 address, two CVE identifiers, and file hashes across SHA256 and MD5. The IPv4 45.142.193[.]132 is the highest-confidence network indicator and should be blocked at egress, proxy, firewall, DNS sinkhole where applicable, and EDR network containment. The SHA256 values are preferred for detection and threat-intel joins because MD5 is collision-prone; use MD5 only for legacy matching and triage. The CVEs are not directly blockable indicators, but they should drive vulnerability scanning, attack surface management, virtual patching, WAF rules, and emergency change control for PaperCut NG/MF.
SOC teams should operationalize the indicators by enriching alerts with asset owner, internet exposure, PaperCut version, Tapestry/XML-RPC enablement, admin interfaces, service-account privileges, and whether the host can reach domain controllers. Decode and pivot using OTX, AbuseIPDB, GreyNoise, VirusTotal, urlscan, Shodan/Censys for exposure, MISP for indicator sharing, and internal EDR/Sysmon telemetry for process lineage. Prioritize sightings where a PaperCut host, Java process, or print service spawns shells, downloads tooling, opens outbound tunnels, or touches credential stores.
Detection Engineering
Sigma detections:
---
title: PaperCut Service Spawning Shell or Downloader After Exploit
id: 9f5a6f44-7f0e-4d26-9b6e-4b2cb7a6a101
status: experimental
description: Detects PaperCut or Java service context spawning command interpreters, downloaders, or script engines consistent with CVE-2026-81578/CVE-2026-82078 exploitation and second RCE staging.
author: Security Arsenal
date: 2026/10/16
tags:
- attack.initial_access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
product: windows
category: process_creation
detection:
selection_parent:
ParentImage|contains:
- 'java.exe'
- 'pc-app.exe'
- 'pc-server.exe'
- 'papercut'
selection_child:
Image|contains:
- 'cmd.exe'
- 'powershell.exe'
- 'pwsh.exe'
- 'rundll32.exe'
- 'wmic.exe'
- 'curl.exe'
- 'certutil.exe'
- 'bitsadmin.exe'
condition: selection_parent and selection_child
falsepositives:
- PaperCut maintenance scripts or managed patching executed from the application server
level: high
---
title: Chisel Reverse SOCKS5 Tunnel or Staging to Exposed Attacker Infrastructure
id: 7d1c8f57-caf6-4c44-9a1d-9d0fd2a4c202
status: experimental
description: Detects Chisel-like reverse SOCKS5 command lines and network connections to 45.142.193.132 associated with the exposed PaperCut attacker workbench.
author: Security Arsenal
date: 2026/10/16
tags:
- attack.command_and_control
- attack.t1090
- attack.t1572
- attack.persistence
logsource:
product: windows
category: process_creation
detection:
selection_cli:
CommandLine|contains:
- 'chisel'
- 'socks5'
- 'reverse'
- '--socks5'
- 'client'
- 'server'
- '45.142.193.132'
selection_suspicious_parent:
ParentImage|contains:
- 'java.exe'
- 'pc-app.exe'
- 'pc-server.exe'
- 'services.exe'
- 'svchost.exe'
condition: selection_cli or (selection_suspicious_parent and selection_cli)
falsepositives:
- Legitimate tunneling approved for remote administration should be allowlisted by host and signer
level: critical
---
title: Credential Store Access After PaperCut or Chisel Activity
id: 3d1f7b68-8ef7-42ee-9d31-5aef42c2f303
status: experimental
description: Detects credential harvesting and Active Directory compromise behavior including NTDS.dit extraction, hive saves, LSASS access tooling, and shadow copy abuse.
author: Security Arsenal
date: 2026/10/16
tags:
- attack.credential_access
- attack.t1003
- attack.t1003.003
- attack.t1552
logsource:
product: windows
category: process_creation
detection:
selection_tools:
Image|contains:
- 'ntdsutil.exe'
- 'vssadmin.exe'
- 'reg.exe'
- 'rundll32.exe'
- 'powershell.exe'
- 'pwsh.exe'
selection_keywords:
CommandLine|contains:
- 'ntds'
- 'ntdsutil'
- 'activate instance ntds'
- 'ifm'
- 'shadow'
- 'copy'
- 'sam'
- 'system'
- 'security'
- 'sekurlsa'
- 'logonpasswords'
- 'comsvcs.dll'
- 'MiniDump'
condition: selection_tools and selection_keywords
falsepositives:
- Approved backup, disaster recovery, or credential audit operations
level: critical
Sentinel hunt query:
let ioc_ip = '45.142.193.132';
let sha256_iocs = dynamic(['c3f7109963b9599eb93fd9a97a4ffa38e672642b35b33608d69e6bbf9f19da4e','14779d0d7ad6be3d7bf9ed78e4ab6016f22dfa7bc8b5d9c43b56011f7fe2ea19']);
let md5_iocs = dynamic(['528cd4e69ecfa5191adbcf6ef28667bf','a6437ac3d6798090a218520985d36a3f','ce870a91e8d27e8f663f0687abc60b04']);
let suspicious_terms = dynamic(['chisel','socks5','reverse','ntdsutil','vssadmin','reg save','secretsdump','sekurlsa','logonpasswords','MiniDump','comsvcs.dll','activate instance ntds','ifm','papercut','tapestry','xml-rpc']);
union isfuzzy=true
(DeviceNetworkEvents
| where RemoteIP == ioc_ip
| project Timestamp, DeviceName, RemoteIP, RemotePort, LocalPort, Protocol, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType),
(DeviceProcessEvents
| where SHA256 in~ (sha256_iocs) or MD5 in~ (md5_iocs) or ProcessCommandLine has_any (suspicious_terms)
or (InitiatingProcessFileName in~ ('java.exe','pc-app.exe','pc-server.exe') and FileName in~ ('cmd.exe','powershell.exe','pwsh.exe','rundll32.exe','wmic.exe','curl.exe','certutil.exe','bitsadmin.exe'))
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, MD5, AccountName, FolderPath)
| order by Timestamp desc
Host hunt script:
$ErrorActionPreference = 'SilentlyContinue'
$iocIp = '45.142.193.132'
$sha256 = @('c3f7109963b9599eb93fd9a97a4ffa38e672642b35b33608d69e6bbf9f19da4e','14779d0d7ad6be3d7bf9ed78e4ab6016f22dfa7bc8b5d9c43b56011f7fe2ea19')
$md5 = @('528cd4e69ecfa5191adbcf6ef28667bf','a6437ac3d6798090a218520985d36a3f','ce870a91e8d27e8f663f0687abc60b04')
$terms = 'chisel|socks5|reverse|ntdsutil|vssadmin|reg save|secretsdump|sekurlsa|logonpasswords|MiniDump|comsvcs.dll|papercut|tapestry|xml-rpc'
Write-Host '[+] Network connections to IOC or tunnel-like remote endpoints'
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq $iocIp -or ($_.State -eq 'Established' -and $_.OwningProcess -ne 0) } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
Write-Host '[+] Suspicious processes and command lines'
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match $terms -or $_.Name -match 'chisel|pc-app|pc-server|java' } | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
Write-Host '[+] Hash matches in common staging paths'
$paths = @($env:TEMP,$env:ProgramData,'C:\Windows\Temp','C:\Users\Public')
foreach ($p in $paths) { Get-ChildItem $p -Recurse -File -Force | ForEach-Object { $s=(Get-FileHash $_.FullName -Algorithm SHA256).Hash; $m=(Get-FileHash $_.FullName -Algorithm MD5).Hash; if ($sha256 -contains $s -or $md5 -contains $m) { [pscustomobject]@{Path=$_.FullName; SHA256=$s; MD5=$m; LastWrite=$_.LastWriteTime} } } }
Write-Host '[+] Persistence locations'
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) { Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match $terms -or $_.Value -match $iocIp } | Select-Object @{n='Key';e={$k}},Name,Value } }
Get-ScheduledTask | Where-Object { ($_.Actions.Execute -match $terms) -or ($_.Actions.Arguments -match $terms) -or ($_.TaskPath -match 'PaperCut|Update|Service') } | Select-Object TaskName,TaskPath,State,@{n='Action';e={($_.Actions.Execute + ' ' + $_.Actions.Arguments)}}
Write-Host '[+] Recent credential-access artifacts'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4673,4656,4663,4688} -MaxEvents 500 | Where-Object { $_.Message -match 'lsass|ntds|sam|security|vssadmin|ntdsutil|reg save|secretdump' } | Select-Object TimeCreated,Id,Message
Response Priorities
- Immediate: block 45.142.193[.]132 and the five hashes at EDR, firewall, proxy, email gateway, and DNS controls; isolate exposed PaperCut NG/MF servers; capture volatile memory, process tree, Prefetch/Amcache, SRUM, ShimCache, USN Journal, web logs, PaperCut logs, and outbound connection history before remediation.
- 24h: assume credential exposure if any PaperCut host shows shells, Chisel, LSASS access, NTDS/SAM/SYSTEM/SECURITY extraction, or unexpected DC connections; rotate domain admin, service, LDAP bind, print admin, local admin, API, and break-glass credentials; revoke tokens and sessions; enforce MFA re-registration checks; reset krbtgt twice only after scoping confirms domain-level compromise.
- 1 week: patch or upgrade PaperCut NG/MF and validate CVE-2026-81578/CVE-2026-82078 exposure with the vendor; restrict Tapestry/XML-RPC and admin interfaces to allowlists; deny print servers direct internet egress except approved update endpoints; segment print infrastructure from domain controllers; remove local admin rights from service accounts; deploy the Sigma/KQL logic, monitor for renamed Chisel, and run attack-path reduction for AD tiering and backup protection.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.