PaperCut NG/MF Emergency Patch Bypass: Defending Print Infrastructure Against Active Exploitation

---
title: PaperCut Application Server Spawning Shell or Scripting Process
id: 3f7a2b1c-9d4e-4a5b-8c6d-2e1f0a9b8c7d
status: experimental
description: Detects the PaperCut NG/MF application server process spawning command shells, scripting engines, or common post-exploitation tooling. This parent-child relationship is a hallmark of remote code execution against the PaperCut service and is extremely rare in legitimate operation.
references:
  - https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\pc-app-64.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; vendor support operations or custom print scripting integrations may spawn cmd.exe. Investigate all hits rather than tuning broadly.
level: high
---
title: PaperCut Application Server Spawning Shell on Linux
id: 8c1d4e5f-2a3b-4c5d-9e6f-7a8b9c0d1e2f
status: experimental
description: Detects the PaperCut NG/MF service process on Linux spawning interactive shells or common post-exploitation interpreters. Indicates likely remote code execution via the PaperCut web application surface.
references:
  - https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'pc-app'
      - 'papercut'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate print scripting hooks may invoke shells but should be documented and scoped to known scripts.
level: high
---
title: Suspicious File Written to PaperCut Web-Served Directories
id: 5e6f7a8b-1c2d-3e4f-5a6b-7c8d9e0f1a2b
status: experimental
description: Detects executable or script content written into PaperCut NG/MF installation and web-served directories, consistent with webshell or dropped-payload staging following exploitation of the application server.
references:
  - https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\PaperCut NG\'
      - '\PaperCut MF\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.aspx'
      - '.php'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
  condition: selection_path and selection_ext
falsepositives:
  - PaperCut upgrades and hotfix installations write legitimate files to these paths. Correlate with change windows; execution-type files (.exe, .dll, .ps1) outside an upgrade window are highly suspicious.
level: high

// Hunt: PaperCut application server spawning unexpected child processes (post-exploitation RCE behavior)
// Scope to your PaperCut hosts. Extend TimeGenerated window to cover the period BEFORE patching — compromise may predate remediation.
let Lookback = 30d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName has_any ("pc-app", "pc-app-64")
   or InitiatingProcessCommandLine has_any ("pc-app", "papercut")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
                      "mshta.exe", "rundll32.exe", "certutil.exe", "curl.exe", "bitsadmin.exe",
                      "whoami.exe", "net.exe", "nltest.exe", "sh", "bash", "python", "python3", "perl", "wget", "nc")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, SHA256, ReportId
| order by TimeGenerated desc;

// Companion hunt: inbound connections to PaperCut management ports from unexpected sources
// Useful to find internet-exposed instances and scanning/exploitation attempts. Tune KnownSubnets to your user VLANs.
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort in (9191, 9192)
| where ActionType == "InboundConnectionAccepted"
| extend RemoteIPType = iff(ipv4_is_private(RemoteIP), "private", "public")
| summarize ConnectionCount = count(), DistinctRemoteIPs = dcount(RemoteIP),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            RemoteIPs = make_set(RemoteIP, 25)
    by DeviceName, LocalPort, RemoteIPType
| where RemoteIPType == "public" or DistinctRemoteIPs > 50
| order by ConnectionCount desc;

-- Hunt: PaperCut application server child processes across the fleet
-- Deploy as a multi-host hunt against all systems identified as PaperCut NG/MF application servers.
-- Any shell/scripting child of pc-app is a strong post-exploitation signal requiring triage.
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       dict(Pid=Ppid).Name AS ParentName,
       dict(Pid=Ppid).Exe AS ParentExe,
       dict(Pid=Ppid).CommandLine AS ParentCommandLine
FROM pslist()
WHERE (ParentExe =~ '(?i)pc-app' OR ParentCommandLine =~ '(?i)papercut|pc-app')
  AND Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|curl|bitsadmin|sh$|bash|python|perl|wget|ncat'

# PaperCut NG/MF emergency patch verification and triage snapshot
# Run elevated on each PaperCut application server. Review output before assuming the host is clean.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Identify installed PaperCut product and version
$installRoots = @("$env:ProgramFiles\PaperCut NG", "$env:ProgramFiles\PaperCut MF")
foreach ($root in $installRoots) {
    if (Test-Path $root) {
        $versionFile = Join-Path $root "app\version.txt"
        $ver = if (Test-Path $versionFile) { (Get-Content $versionFile -TotalCount 1).Trim() } else { "version.txt not found - check via admin UI (Options > About)" }
        $report += "[+] Install root : $root"
        $report += "[+] Build version: $ver"
        $report += "[!] ACTION: Compare this build against the SECOND emergency release in the PaperCut security advisory (https://www.papercut.com/kb/Main/SecurityAdvisories). The first emergency patch is insufficient."
    }
}

# 2. Confirm PaperCut application service state
$svc = Get-Service | Where-Object { $_.DisplayName -match 'PaperCut' }
foreach ($s in $svc) { $report += "[+] Service: $($s.Name) - Status: $($s.Status) - StartType: $($s.StartType)" }

# 3. Triage: recent child processes spawned by the PaperCut application process
$pcProcs = Get-CimInstance Win32_Process | Where-Object { $_.Name -match '^pc-app' }
foreach ($p in $pcProcs) {
    $children = Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $p.ProcessId }
    foreach ($c in $children) {
        if ($c.Name -match 'cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|curl|bitsadmin|whoami|net\.exe') {
            $report += "[CRITICAL] Suspicious child of pc-app (PID $($p.ProcessId)): $($c.Name) - $($c.CommandLine)"
        } else {
            $report += "[i] Child of pc-app (PID $($p.ProcessId)): $($c.Name)"
        }
    }
}

# 4. Triage: files modified in the last 14 days inside the install directory (webshell/payload staging)
foreach ($root in $installRoots) {
    if (Test-Path $root) {
        $recent = Get-ChildItem $root -Recurse -File -Include *.jsp,*.jspx,*.aspx,*.php,*.exe,*.dll,*.ps1,*.bat |
                  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) }
        foreach ($f in $recent) { $report += "[REVIEW] Recently modified: $($f.FullName) - $($f.LastWriteTime)" }
    }
}

# 5. Check whether management ports are listening and flag exposure
$listeners = Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in 9191,9192 }
foreach ($l in $listeners) { $report += "[!] Listening on TCP $($l.LocalPort) ($($l.LocalAddress)) - confirm this is firewalled to admin/user subnets only and NOT internet-reachable" }

$report | Out-File "$env:TEMP\papercut-triage.txt"
$report | ForEach-Object { Write-Output $_ }
Write-Output "`nReport written to $env:TEMP\papercut-triage.txt - preserve for IR review if any [CRITICAL] or unexpected [REVIEW] entries appear."