PaperCut NG/MF Zero-Day Under Active Exploitation: Detection, Hunt, and Emergency Patch Guide

---
title: PaperCut Application Server Spawning Suspicious Child Processes
id: 8f4a2c17-9b3d-4e5a-a1f2-6c8d9e0b1a34
status: experimental
description: Detects the PaperCut NG/MF application server process spawning command interpreters, downloaders, or script engines. This behavior is a hallmark of post-exploitation activity following compromise of the PaperCut web service and is almost never legitimate in production.
references:
  - https://thehackernews.com/2026/08/papercut-zero-day-exploited-in-attacks.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/08
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\pc-print-provider.exe'
      - '\pc-monitor.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\nltest.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate PaperCut administrative scripts invoked via the admin interface
  - PaperCut support-initiated troubleshooting (correlate with vendor support tickets)
level: critical
---
title: Web Shell or Suspicious File Written to PaperCut Web Directories
id: 3d7e9b45-2a1c-4f6e-b8d3-5a9c0e1f2b47
status: experimental
description: Detects creation of executable web content (JSP, JS, EXE, script files) inside PaperCut NG/MF web-serving directories, a known persistence mechanism used in prior PaperCut compromise campaigns.
references:
  - https://thehackernews.com/2026/08/papercut-zero-day-exploited-in-attacks.html
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/08/08
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\papercut\server\data\web'
      - '\papercut ng\server\custom\web'
      - '\papercut mf\server\custom\web'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.cmd'
      - '.vbs'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate custom branding/report content placed by PaperCut administrators (validate against change records)
  - PaperCut installer/patcher activity (filter by expected patch windows and signed process lineage)
level: high
---
title: PaperCut Service Making Suspicious Outbound Network Connections
id: 6b1c8d29-4e7a-4f3b-9c2d-8a5e0f1b3d56
status: experimental
description: Detects the PaperCut application server process initiating outbound connections to uncommon external destinations. Compromised print servers are used for C2, payload retrieval, and exfiltration; baseline-approved PaperCut cloud licensing traffic should be allowlisted.
references:
  - https://thehackernews.com/2026/08/papercut-zero-day-exploited-in-attacks.html
  - https://attack.mitre.org/techniques/T1071.001/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/08
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\pc-app.exe'
  selection_remote:
    Initiated: 'true'
  filter_papercut_cloud:
    DestinationHostname|contains:
      - 'papercut.com'
      - 'papercut-mobility.com'
      - 'windows.net'
      - 'amazonaws.com'
  filter_local:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection_process and selection_remote and not 1 of filter_*
falsepositives:
  - PaperCut cloud services, licensing, and payment gateway callbacks (allowlist per your documented deployment)
  - Legitimate integrations (Google Workspace, Azure AD sync)
level: medium

// PaperCut NG/MF post-exploitation hunt — child processes, web shell writes, anomalous egress
let Lookback = 7d;
let PaperCutProcs = dynamic(["pc-app.exe", "pc-print-provider.exe", "pc-monitor.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "curl.exe", "bitsadmin.exe", "whoami.exe", "net.exe", "nltest.exe"]);
let ChildExec =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName in~ (PaperCutProcs)
    | where FileName in~ (SuspiciousChildren)
    | project ChildExecTime = Timestamp, DeviceName, DeviceId, ParentProc = InitiatingProcessFileName,
              ChildProc = FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, ReportId;
let WebShellWrites =
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where FolderPath has_any ("papercut\\server\\data\\web", "papercut ng\\server\\custom\\web", "papercut mf\\server\\custom\\web", "/opt/papercut/server/data/web", "/opt/papercut/server/custom/web")
    | where FileName endswith ".jsp" or FileName endswith ".jspx" or FileName endswith ".exe"
        or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".sh"
    | project WebShellWriteTime = Timestamp, DeviceName, DeviceId, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine;
let AnomalousEgress =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName =~ "pc-app.exe"
    | where RemoteIPType == "Public"
    | where RemoteUrl !has "papercut.com"
    | project EgressTime = Timestamp, DeviceName, DeviceId, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine;
ChildExec
| join kind=leftouter (WebShellWrites) on DeviceId
| join kind=leftouter (AnomalousEgress) on DeviceId
| project DeviceName, ChildExecTime, ParentProc, ChildProc, ProcessCommandLine, WebShellWriteTime, FolderPath, FileName, EgressTime, RemoteIP, RemoteUrl, AccountName
| sort by ChildExecTime desc

-- Hunt: PaperCut NG/MF exploitation indicators
-- Identifies suspicious child processes of PaperCut services and anomalous files in PaperCut web directories

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid
    FROM pslist()
    WHERE Name =~ '(?i)pc-app|pc-print-provider|pc-monitor'
)
AND Name =~ '(?i)(cmd|powershell|pwsh|mshta|rundll32|regsvr32|certutil|curl|wget|bitsadmin|whoami|nltest|net\.exe|bash|sh)'

UNION ALL

SELECT NULL AS Pid, NULL AS Ppid, FullPath AS Name, NULL AS Exe,
       'File in PaperCut web directory' AS CommandLine,
       NULL AS Username, Mtime AS CreateTime
FROM glob(globs=[
    'C:/Program Files/PaperCut*/server/data/web/**/*.jsp',
    'C:/Program Files/PaperCut*/server/custom/web/**/*.jsp',
    '/opt/papercut/server/data/web/**/*.jsp',
    '/opt/papercut/server/custom/web/**/*.jsp'
])
WHERE Mtime > time(
    string=cast(format='%v', timestamp=now() - 7*24*3600)
)

# PaperCut NG/MF — Emergency Patch Verification & Compromise Triage
# Run elevated on the PaperCut Application Server

Write-Host "=== PaperCut Emergency Patch Verification ===" -ForegroundColor Cyan

# 1. Identify installed PaperCut version
$pcPath = Get-ChildItem "C:\Program Files" -Directory -Filter "PaperCut*" -ErrorAction SilentlyContinue
if ($pcPath) {
    Write-Host "[+] PaperCut installation found: $($pcPath.FullName)"
    $verFile = Join-Path $pcPath.FullName "server\VERSION.txt"
    if (Test-Path $verFile) { Write-Host "[+] Version: $(Get-Content $verFile -Raw)" }
    else { Write-Host "[!] VERSION.txt not found — check Admin UI > About for build number" }
} else {
    Write-Host "[-] No PaperCut installation detected on this host"
    exit
}

# 2. Confirm target state: v25/v26 emergency-patched build
Write-Host "[i] REQUIRED: Emergency patch from PaperCut for v25/v26 release trains."
Write-Host "[i] Verify your build against the version in PaperCut's security advisory before continuing."

# 3. List PaperCut services and status
Get-Service -DisplayName "*PaperCut*" -ErrorAction SilentlyContinue |
    Select-Object Name, DisplayName, Status, StartType | Format-Table -AutoSize

# 4. Flag recently modified executable content in web directories (potential web shells)
Write-Host "`n=== Recently modified files in PaperCut web directories (last 14 days) ===" -ForegroundColor Yellow
Get-ChildItem -Path "$($pcPath.FullName)\server\data\web", "$($pcPath.FullName)\server\custom\web" `
    -Recurse -Include *.jsp,*.jspx,*.exe,*.dll,*.ps1,*.bat -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize

# 5. Review listening ports — confirm 9191/9192 exposure scope
Write-Host "`n=== PaperCut listening ports ===" -ForegroundColor Yellow
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 9191,9192,9193 } |
    Select-Object LocalAddress, LocalPort, OwningProcess | Format-Table -AutoSize

# 6. Check for child processes spawned by PaperCut services in last 7 days (requires Defender/EDR telemetry)
Write-Host "`n[i] TIP: Run the companion Sentinel/Defender KQL hunt to check for post-exploitation child processes."
Write-Host "[i] If ANY anomalies appear above: isolate the host from the network and initiate IR procedures."

#!/bin/bash
# PaperCut NG/MF — Linux Emergency Patch Verification & Compromise Triage

echo "=== PaperCut Installation Check ==="
if [ -d /opt/papercut ]; then
    cat /opt/papercut/server/VERSION.txt 2>/dev/null || echo "[!] Check Admin UI > About for build"
else
    echo "[-] No PaperCut installation found"; exit 0
fi

echo -e "\n=== Service Status ==="
systemctl status pc-app pc-event-monitor 2>/dev/null | head -20

echo -e "\n=== Recently modified web content (potential web shells) ==="
find /opt/papercut/server/data/web /opt/papercut/server/custom/web \
    -type f \( -name "*.jsp" -o -name "*.jspx" -o -name "*.sh" -o -name "*.py" \) \
    -mtime -14 -ls 2>/dev/null

echo -e "\n=== Listening ports 9191/9192/9193 ==="
ss -tlnp | grep -E '9191|9192|9193'

echo -e "\n=== Suspicious child processes of pc-app (live check) ==="
PCAPP_PID=$(pgrep -f "pc-app" | head -1)
if [ -n "$PCAPP_PID" ]; then
    ps --ppid "$PCAPP_PID" -o pid,ppid,comm,args 2>/dev/null
fi

echo -e "\n=== Outbound connections from PaperCut process ==="
ss -tnp | grep "pc-app" | grep -v ESTAB.*:9191 | grep -v ESTAB.*:9192