PaperCut NG/MF Mass Exploitation: AI-Orchestrated Campaign Compromises 440+ Instances — Detection and Remediation Guide

---
title: PaperCut Application Server Spawning Command Shell
title_note: Detects pc-app.exe spawning cmd/powershell — primary indicator of PaperCut NG/MF RCE
id: 3f8c1a92-7b4d-4e61-9c05-2a7d8f1b3e44
status: experimental
description: Detects the PaperCut application server process spawning command interpreters or scripting engines, consistent with remote code execution against PaperCut NG/MF. This behavior is near-zero in healthy environments and was the hallmark of prior PaperCut exploitation campaigns.
references:
  - https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
  - attack.exploit_public_facing_application
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\pc-app-service.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare administrative scripting legitimately invoked by PaperCut print scripting — validate against change records
level: critical
---
title: Outbound Connection to PaperCut Campaign Infrastructure
id: 8d2e5b17-4c6a-4f39-a1d8-6e9b2c4a5f77
status: experimental
description: Detects network connections to 45.142.193.132, the IP attributed by Blackpoint Cyber and GreyNoise to the mass PaperCut NG/MF exploitation campaign. Any hit warrants immediate incident response.
references:
  - https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.exploit_public_facing_application
  - attack.t1190
  - attack.command_and_control
logsource:
  category: network_connection
detection:
  selection:
    DestinationIp: '45.142.193.132'
  condition: selection
falsepositives:
  - None expected — this IP has no legitimate business purpose in typical environments
level: critical
---
title: PaperCut Server Anomalous Child Process on Linux
id: 1b7a9d34-8e2f-4c55-b3a1-9f4c6d8e2a10
status: experimental
description: Detects the PaperCut Java application process on Linux spawning shells or download tools, indicating post-exploitation activity consistent with the AI-orchestrated PaperCut campaign.
references:
  - https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'papercut'
      - 'pc-app'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Custom PaperCut print scripting hooks invoking shell commands — review configured scripts
level: high

// Hunt 1: PaperCut application server spawning suspicious child processes
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("pc-app.exe", "pc-app-service.exe", "java.exe")
| where InitiatingProcessCommandLine has_any ("papercut", "pc-app") or InitiatingProcessFileName has "pc-app"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc

// Hunt 2: Any endpoint or network device communicating with campaign infrastructure
let CampaignIP = "45.142.193.132";
union isfuzzy=true
    (DeviceNetworkEvents
     | where TimeGenerated > ago(30d)
     | where RemoteIP == CampaignIP
     | project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine),
    (CommonSecurityLog
     | where TimeGenerated > ago(30d)
     | where DestinationIP == CampaignIP or SourceIP == CampaignIP
     | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, Protocol, Message),
    (Syslog
     | where TimeGenerated > ago(30d)
     | where SyslogMessage has CampaignIP
     | project TimeGenerated, Computer, ProcessName, SyslogMessage)
| order by TimeGenerated desc

-- Security Arsenal: PaperCut NG/MF exploitation hunt
-- Surfaces suspicious child processes of the PaperCut app server and connections to campaign infrastructure

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|certutil|bitsadmin|curl|wget|/bin/(ba)?sh)'
  AND (
    Ppid IN (SELECT Pid FROM pslist() WHERE Exe =~ '(?i)(pc-app|papercut)')
    OR Exe =~ '(?i)(pc-app|papercut)'
  )

// Separately, check live network connections for the campaign IP
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE RemoteAddr =~ '45\\.142\\.193\\.132'

# Security Arsenal - PaperCut NG/MF compromise assessment & IOC check
# Run elevated on each PaperCut application server

Write-Host "=== PaperCut Version Check ===" -ForegroundColor Cyan
$pcPath = "C:\Program Files\PaperCut NG" , "C:\Program Files\PaperCut MF"
foreach ($p in $pcPath) {
    if (Test-Path $p) {
        Write-Host "Install found: $p"
        Get-ChildItem $p -Filter "*.version" -ErrorAction SilentlyContinue | Get-Content
        # Also pull product version from the main binary
        $exe = Join-Path $p "server\bin\win\pc-app.exe"
        if (Test-Path $exe) { (Get-Item $exe).VersionInfo | Select-Object ProductVersion, FileVersion }
    }
}

Write-Host "`n=== Suspicious child processes of pc-app.exe (live) ===" -ForegroundColor Cyan
$pcPids = Get-CimInstance Win32_Process -Filter "Name='pc-app.exe'" | Select-Object -ExpandProperty ProcessId
if ($pcPids) {
    Get-CimInstance Win32_Process | Where-Object { $pcPids -contains $_.ParentProcessId } |
        Select-Object ProcessId, Name, CommandLine, CreationDate | Format-List
} else { Write-Host "pc-app.exe not currently running." }

Write-Host "`n=== Connections to campaign IP 45.142.193.132 ===" -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq "45.142.193.132" } | Format-Table -AutoSize
$fwHit = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156} -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match '45\.142\.193\.132' }
if ($fwHit) { $fwHit | Select-Object TimeCreated, Message -First 20 } else { Write-Host "No firewall log hits (or logging disabled)." }

Write-Host "`n=== Recent PaperCut server log anomalies ===" -ForegroundColor Cyan
$logDir = "$p\server\logs"
if (Test-Path $logDir) {
    Get-ChildItem $logDir -Filter "server.log*" | Sort-Object LastWriteTime -Descending | Select-Object -First 2 |
        ForEach-Object {
            Write-Host "Scanning $($_.Name) for error/exploit patterns..."
            Select-String -Path $_.FullName -Pattern "(?i)(error|exception|unauthor|script|exec|\.jsp|\.aspx|webshell)" |
                Select-Object -First 30 | ForEach-Object { $_.Line }
        }
}

Write-Host "`n=== Block campaign IP at host firewall (defense-in-depth) ===" -ForegroundColor Cyan
New-NetFirewallRule -DisplayName "BLOCK - PaperCut Campaign C2 45.142.193.132" `
    -Direction Outbound -RemoteAddress 45.142.193.132 -Action Block -ErrorAction SilentlyContinue
New-NetFirewallRule -DisplayName "BLOCK - PaperCut Campaign C2 45.142.193.132 Inbound" `
    -Direction Inbound -RemoteAddress 45.142.193.132 -Action Block -ErrorAction SilentlyContinue
Write-Host "Firewall block rules created."

# Security Arsenal - Linux PaperCut assessment
set -euo pipefail

echo "=== PaperCut version ==="
cat /opt/papercut/server/VERSION 2>/dev/null || ls /opt/papercut/server/

echo "=== PaperCut process tree (look for shell children) ==="
PC_PID=$(pgrep -f "papercut" | head -5 || true)
if [ -n "$PC_PID" ]; then
  for pid in $PC_PID; do
    echo "--- children of $pid ---"
    ps --ppid "$pid" -o pid,ppid,user,cmd 2>/dev/null || true
  done
fi

echo "=== Connections to campaign IP ==="
ss -tnp | grep "45.142.193.132" || echo "No live connections."
grep -r "45.142.193.132" /var/log/ 2>/dev/null | head -20 || echo "No log hits."

echo "=== Block campaign IP ==="
iptables -C INPUT -s 45.142.193.132 -j DROP 2>/dev/null || iptables -A INPUT -s 45.142.193.132 -j DROP
iptables -C OUTPUT -d 45.142.193.132 -j DROP 2>/dev/null || iptables -A OUTPUT -d 45.142.193.132 -j DROP
echo "iptables rules applied (persist with iptables-save / netfilter-persistent)."

echo "=== Recent PaperCut server.log anomalies ==="
tail -5000 /opt/papercut/server/logs/server.log 2>/dev/null | \
  grep -iE "error|exception|unauthor|script|exec" | tail -30 || echo "No server.log found."