Two security vulnerabilities in PaperCut NG and MF — the print management platform deployed across tens of thousands of enterprises, universities, and government agencies — were patched last week and are already being abused in data theft attacks. This is the pattern defenders dread most: the gap between vendor disclosure and active exploitation measured in days, not months.
If you operate PaperCut NG or MF anywhere in your environment, treat this as an active incident until proven otherwise. Print management servers are high-value targets: they sit inside the network perimeter, hold credentials for service accounts and directory integrations, store documents and user metadata, and are frequently forgotten by both patch management and EDR coverage policies. That combination makes them ideal staging points for data theft and lateral movement.
This is not PaperCut's first time in the crosshairs — prior exploitation waves against this platform were leveraged by ransomware affiliates and state-aligned actors for initial access. Defenders should assume the current campaign will follow the same trajectory and act accordingly.
Technical Analysis
Affected Products
- PaperCut NG — print management software for Windows, Linux, and macOS servers
- PaperCut MF — the enterprise/MFP-integrated variant, same underlying application server codebase
Both products ship an embedded web application server (the pc-app process) that exposes administrative and user-facing interfaces, typically on TCP ports 9191 (HTTP) and 9192/9193 (HTTPS). The application server runs with elevated privileges — frequently SYSTEM on Windows or a dedicated service account with broad filesystem access on Linux — which is precisely why compromise of this component is so damaging.
The Vulnerabilities and Attack Chain
Per the reporting, two vulnerabilities patched in the vendor's most recent release are now being exploited in the wild for data theft. While the vendor has not yet published full technical detail on the flaw mechanics, the observed campaign behavior is consistent with the classic PaperCut exploitation chain defenders know well:
- Reconnaissance: Attackers scan for internet-exposed PaperCut instances on ports 9191/9192/9193. Shodan and Censys make this trivially easy — a fresh vulnerability disclosure triggers mass scanning within hours.
- Unauthenticated exploitation: The flaws are being triggered remotely against the web application component without valid credentials — consistent with authentication bypass or improper input handling in the application server.
- Code execution under the service context: Successful exploitation yields command execution as the PaperCut service account, observed as the
pc-appapplication server process spawning child shells and scripting interpreters. - Data theft: Operators access stored print job data, user directories, integrated identity stores (LDAP/AD bind credentials are commonly configured in PaperCut), and staged documents, then exfiltrate.
Why Print Servers Are a Force Multiplier for Attackers
PaperCut servers typically hold: AD/LDAP service account credentials for directory sync, databases of users and print activity, copies of printed/scanned documents (often containing sensitive HR, legal, and financial content), and network trust relationships with endpoints across the fleet. A compromise here is rarely contained to the print system.
Exploitation Status
- Confirmed active exploitation in the wild — data theft attacks are occurring now, not theoretical or PoC-only.
- Patch available — the vendor released fixes last week; exploitation began after disclosure.
- Assessment: Expect CISA KEV addition and ransomware-affinity adoption if exploitation continues to scale. Organizations should not wait for KEV listing to treat this as an emergency patch.
Detection & Response
The most reliable detection anchor for PaperCut exploitation — across every historical campaign against this platform — is the application server process spawning unexpected child processes. The PaperCut pc-app process has no legitimate reason to spawn cmd.exe, powershell.exe, bash, or sh in normal operation. This is a high-fidelity signal.
Sigma Rules
---
title: PaperCut Application Server Spawning Shell or Scripting Interpreter
id: 3f8a1c94-7b2e-4d51-9a06-2e8c4f7b1a35
status: experimental
description: Detects the PaperCut application server process (pc-app.exe) spawning command shells, scripting engines, or system utilities — a hallmark of web application exploitation leading to remote code execution, as observed in active PaperCut data theft campaigns.
references:
- https://www.bleepingcomputer.com/news/security/recently-patched-papercut-zero-days-used-in-data-theft-attacks/
- https://attack.mitre.org/techniques/T1190/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\pc-app.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\net.exe'
- '\net1.exe'
- '\whoami.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\curl.exe'
- '\wmic.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare administrative scripts invoked by PaperCut integrations — validate against documented vendor hotfolder/scripting configurations
level: critical
---
title: PaperCut Application Server Spawning Shell on Linux
id: 9c4d2e71-5a8f-4b36-8d17-6f3a9c2e5b48
status: experimental
description: Detects the PaperCut application server (pc-app) spawning shells or download utilities on Linux print servers — consistent with post-exploitation activity following remote exploitation of PaperCut NG/MF vulnerabilities.
references:
- https://www.bleepingcomputer.com/news/security/recently-patched-papercut-zero-days-used-in-data-theft-attacks/
- https://attack.mitre.org/techniques/T1190/
- https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.execution
- attack.t1190
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: '/pc-app'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/python'
- '/python3'
- '/perl'
- '/curl'
- '/wget'
- '/nc'
- '/ncat'
- '/base64'
- '/tar'
condition: selection_parent and selection_child
falsepositives:
- Documented PaperCut print provider scripts — review any /home/papercut custom script integrations
level: critical
---
title: Inbound Connection to PaperCut Web Interface From External Source
id: 5e7b3f12-9d4a-4c68-a291-8f6d1e3b7c52
status: experimental
description: Identifies inbound network connections to PaperCut administrative web ports (9191-9193) from untrusted or internet-routable sources. PaperCut web interfaces should never be internet-exposed; external connections indicate reconnaissance or exploitation attempts against the application server.
references:
- https://www.bleepingcomputer.com/news/security/recently-patched-papercut-zero-days-used-in-data-theft-attacks/
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: '\pc-app.exe'
DestinationPort:
- 9191
- 9192
- 9193
Initiated: 'false'
filter_internal:
SourceIp|startswith:
- '10.'
- '172.16.'
- '172.17.'
- '172.18.'
- '172.19.'
- '172.2'
- '172.30.'
- '172.31.'
- '192.168.'
- '127.'
condition: selection and not filter_internal
falsepositives:
- Misconfigured load balancers or NAT — any match still warrants immediate review of exposure
level: high
KQL — Microsoft Sentinel / Defender
This query hunts for the exploitation signature on both Windows (via Defender process telemetry) and Linux (via ingested Syslog), plus outbound connections from the PaperCut process that may indicate exfiltration:
let papercut_children = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","net.exe","whoami.exe","certutil.exe","curl.exe","curl","wget","bash","sh","python","python3","tar","nc"]);
let win = DeviceProcessEvents
| where InitiatingProcessFileName =~ "pc-app.exe"
| where FileName in~ (papercut_children)
| extend Platform = "Windows"
| project TimeGenerated, Platform, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReportId;
let lin = Syslog
| where ProcessName =~ "pc-app" or SyslogMessage has "pc-app"
| where SyslogMessage has_any ("bash","/bin/sh","curl","wget","python","tar ","base64")
| extend Platform = "Linux"
| project TimeGenerated, Platform, Computer, ProcessName, SyslogMessage;
win
| union lin
| order by TimeGenerated desc
;
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "pc-app.exe"
| where not (RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.1" or RemoteIP startswith "172.2" or RemoteIP startswith "172.30." or RemoteIP startswith "172.31." or RemoteIP startswith "127.")
| where RemotePort !in (80, 443)
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemotePort
| order by Connections desc
Tune the outbound-connection leg against your known PaperCut cloud services traffic (PaperCut MF may legitimately phone home for licensing — baseline those destinations first, then alert on everything else).
Velociraptor VQL
Use this hunt artifact to identify suspicious child processes of the PaperCut application server across your fleet — the primary post-exploitation indicator:
-- Hunt for suspicious child processes of the PaperCut application server
-- High-fidelity indicator of web exploitation leading to command execution
LET parents = SELECT Pid
FROM pslist()
WHERE Name =~ '(?i)pc-app'
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM parents)
AND Name =~ '(?i)(cmd|powershell|pwsh|sh|bash|curl|wget|python|perl|nc|ncat|tar|base64|net|whoami|certutil)'
Also pull the PaperCut server logs during scoping — the application logs HTTP requests to its embedded web server, and exploitation attempts frequently leave anomalous request patterns (unexpected URIs, requests from foreign IPs, session anomalies):
-- Collect PaperCut server logs for review of anomalous web requests
SELECT FullPath, Size, Mtime
FROM glob(globs=[
'C:/Program Files/PaperCut*/server/logs/server.log*',
'C:/Program Files/PaperCut*/server/logs/*.log',
'/home/papercut/server/logs/server.log*',
'/opt/papercut/server/logs/server.log*'
])
ORDER BY Mtime DESC
Rapid Triage Script
Run this on each PaperCut server to verify version, enumerate the process tree under the application server, check for rogue local administrators, and pull recent log evidence:
# PaperCut Compromise Triage - run elevated on each PaperCut NG/MF server
# 1. Identify installed PaperCut version (compare against the vendor's fixed release)
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -match 'PaperCut' } |
Select-Object DisplayName, DisplayVersion, InstallDate
# 2. Enumerate the full process tree under pc-app.exe (exploitation => shells/tools as children)
$pcApp = Get-CimInstance Win32_Process -Filter "Name = 'pc-app.exe'"
foreach ($p in $pcApp) {
Get-CimInstance Win32_Process -Filter "ParentProcessId = $($p.ProcessId)" |
Select-Object ProcessId, Name, CommandLine, CreationDate
}
# 3. Hunt recent child-of-pc-app executions in the Security log (requires process creation auditing)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'pc-app\.exe' } |
Select-Object TimeCreated, Message -First 100
# 4. Check for rogue local administrator accounts created in the last 30 days
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | ForEach-Object {
$u = Get-LocalUser -Name ($_.Name -split '\\')[-1] -ErrorAction SilentlyContinue
if ($u) { [PSCustomObject]@{ Name = $u.Name; Enabled = $u.Enabled; LastLogon = $u.LastLogon; PasswordLastSet = $u.PasswordLastSet } }
}
# 5. Stage PaperCut server logs for review (anomalous web requests, auth bypass artifacts)
$logPath = 'C:\Program Files\PaperCut MF\server\logs'
if (Test-Path $logPath) {
Get-ChildItem $logPath -Filter '*.log' | Sort-Object LastWriteTime -Descending |
Select-Object FullName, Length, LastWriteTime -First 20
}
For Linux-hosted PaperCut:
# 1. Confirm PaperCut version and patch state
cat /home/papercut/server/version.txt 2>/dev/null || cat /opt/papercut/server/version.txt 2>/dev/null
# 2. Enumerate the process tree under pc-app
PCAPP_PID=$(pgrep -f "pc-app" | head -1)
ps --ppid "$PCAPP_PID" -o pid,ppid,user,comm,args
# 3. Search server logs for anomalous requests and errors around exploitation windows
grep -iE "error|exception|unauthoriz|bypass|setupcompleted" /home/papercut/server/logs/server.log* 2>/dev/null | tail -200
# 4. Review auth logs for interactive logons by the papercut service account (should never occur)
grep -i "papercut" /var/log/auth.log* 2>/dev/null | grep -iE "session opened|accepted" | tail -50
# 5. Check for recently created or modified accounts
cut -d: -f1 /etc/passwd | while read u; do last -1 "$u" 2>/dev/null; done | grep -v "never logged in"
Remediation
- Patch immediately. Upgrade PaperCut NG/MF to the latest fixed release published in the vendor's security bulletin. Pull the exact fixed version numbers and download links directly from the official PaperCut security advisories page:
https://www.papercut.com/kb/Main/SecurityBulletins. Do not rely on package managers or cached installers — verify the installed build against the bulletin after upgrade. - Assume compromise until scoped. Because exploitation began after the patch release, patching alone does not evict an intruder. For every PaperCut server, run the triage above, review server logs for the exploitation window (from patch-release date forward), and hunt for child processes, rogue accounts, and unusual outbound connections.
- Remove internet exposure. PaperCut's web interfaces (TCP 9191/9192/9193) must never be reachable from the internet. Verify with external scanning, enforce at the perimeter firewall, and restrict administrative interface access to a management VLAN or jump host.
- Rotate credentials on suspicion. If any indicator of compromise is found, rotate every credential the server touched: the PaperCut service account, AD/LDAP bind accounts configured in directory sync, database credentials, and any API keys for integrated MFPs or payment gateways.
- Harden the service context. Run PaperCut under a least-privilege service account rather than SYSTEM/root where operationally supported, and segment print servers so they cannot initiate outbound connections beyond required vendor endpoints.
- Expand EDR coverage. Print management servers are classic EDR blind spots. Confirm your PaperCut hosts have sensor coverage with process creation auditing (Event ID 4688 with command line on Windows, auditd on Linux) so the detections above actually fire.
- Monitor for follow-on activity. Data theft campaigns against management infrastructure frequently precede extortion and ransomware deployment. Watch for staging archives, exfiltration to unfamiliar destinations, and credential dumping on adjacent systems for at least 30 days post-remediation.
The lesson repeats itself: internet-facing management appliances with privileged internal access are the highest-leverage targets in your environment. The patch window is measured in days now. Your vulnerability management program needs to treat vendor security bulletins for this class of software as emergency change requests, not Tuesday maintenance items.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.