PaperCut Print Servers Under Active Attack: 47% Still Unpatched — Detection and Remediation Guide

---
title: PaperCut Application Server Spawning Command Interpreter
id: 3f8a2b91-7c4e-4d1a-9b62-8e5f0a1c2d34
status: experimental
description: Detects the PaperCut application server process spawning cmd, PowerShell, or scripting engines — a strong indicator of post-exploitation activity following unauthenticated RCE against PaperCut MF/NG.
references:
  - https://securityaffairs.com/198107/uncategorized/hackers-are-probing-papercut-servers-and-47-still-have-no-patch.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\pc-app.exe'
      - '\papercut.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — PaperCut may invoke scripts for custom print job workflows, but direct spawning of command interpreters by the application server is highly anomalous in most environments
level: high
---
title: PaperCut Server Outbound Payload Download
id: 9c1d4e72-3a8b-4f56-b2c7-6d9e1f0a3b45
status: experimental
description: Detects the PaperCut application server process making outbound network connections to uncommon external hosts, consistent with second-stage payload retrieval after exploitation.
references:
  - https://securityaffairs.com/198107/uncategorized/hackers-are-probing-papercut-servers-and-47-still-have-no-patch.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\pc-app.exe'
    Initiated: 'true'
  filter_updates:
    DestinationHostname|contains:
      - 'papercut.com'
      - 'papercut-ng.com'
      - 'windowsupdate.com'
      - 'microsoft.com'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '192.168.'
  condition: selection and not 1 of filter_*
falsepositives:
  - License validation and telemetry to PaperCut domains (filtered above)
  - Cloud print provider integrations — baseline your environment's legitimate destinations before enabling at high severity
level: medium
---
title: PaperCut Linux Server Shell Spawning
id: 5e7b9a14-2f6c-4d38-a1b9-4c8e2d6f0a57
status: experimental
description: Detects the PaperCut server process on Linux spawning shells or download utilities, indicative of post-exploitation command execution.
references:
  - https://securityaffairs.com/198107/uncategorized/hackers-are-probing-papercut-servers-and-47-still-have-no-patch.html
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'pc-app'
      - 'papercut'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Administrative maintenance performed directly on the PaperCut host
  - Custom PaperCut integration scripts — validate against change records
level: high

// Hunt 1: PaperCut server spawning command interpreters or LOLBins
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "pc-app.exe"
   or InitiatingProcessFolderPath has "PaperCut"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
    "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe",
    "wmic.exe", "curl.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName,
    ProcessCommandLine, AccountName, InitiatingProcessAccountName, SHA256
| order by TimeGenerated desc
;
// Hunt 2: PaperCut servers with outbound connections to non-standard destinations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "pc-app.exe"
   or InitiatingProcessFolderPath has "PaperCut"
| where RemoteIPType == "Public"
| where not(RemoteUrl has_any ("papercut.com", "papercut-ng.com", "microsoft.com"))
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP, 20),
    RemoteUrls = make_set(RemoteUrl, 20), Ports = make_set(RemotePort, 10)
    by DeviceName, InitiatingProcessFileName
| order by ConnectionCount desc
;
// Hunt 3: Identify all devices running PaperCut to scope patching (via process observation)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FolderPath has "PaperCut" or FileName =~ "pc-app.exe"
| summarize LastSeen = max(TimeGenerated), Versions = make_set(ProcessVersionInfoProductVersion, 5)
    by DeviceName
| order by LastSeen desc

-- PaperCut compromise triage: child processes, dropped files, and network connections
-- Hunt 1: Suspicious child processes spawned by PaperCut application server
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell|cmd\.exe|wscript|cscript|mshta|certutil|bitsadmin|curl|wget)'
  AND (
    CommandLine =~ '(?i)papercut'
    OR Exe =~ '(?i)papercut'
  )
;
-- Hunt 2: Recently created executables/scripts in PaperCut directories (last 30 days)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:\\Program Files\\PaperCut MF\\**')
WHERE NOT IsDir
  AND Mtime > (now() - 2592000)
  AND FullPath =~ '(?i)\.(exe|dll|bat|ps1|vbs|js|jsp|war)$'
ORDER BY Mtime DESC
;
-- Hunt 3: Outbound connections from PaperCut processes
SELECT Pid, Name, Status, LocalAddr, LocalPort, RemoteAddr, RemotePort
FROM netstat()
WHERE Name =~ '(?i)(pc-app|java|papercut)'
  AND Status =~ 'ESTABLISHED'
  AND NOT RemoteAddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

# PaperCut Server Assessment and Hardening Script
# Run as Administrator on PaperCut MF/NG application servers

# --- Step 1: Identify PaperCut installation and version ---
$pcPaths = @("C:\Program Files\PaperCut MF", "C:\Program Files\PaperCut NG")
foreach ($path in $pcPaths) {
    if (Test-Path $path) {
        Write-Host "[+] PaperCut installation found: $path" -ForegroundColor Green
        $exe = Get-Item "$path\server\bin\pc-app.exe" -ErrorAction SilentlyContinue
        if ($exe) {
            Write-Host "    Version: $($exe.VersionInfo.ProductVersion)"
            Write-Host "    ACTION REQUIRED: Compare against vendor-fixed version in the PaperCut advisory."
        }
    }
}

# --- Step 2: Check PaperCut service account privileges ---
Get-Service | Where-Object { $_.DisplayName -match "PaperCut" } | ForEach-Object {
    $svc = Get-WmiObject Win32_Service -Filter "Name='$($_.Name)'"
    Write-Host "[+] Service: $($_.DisplayName) | State: $($_.State) | RunAs: $($svc.StartName)"
    if ($svc.StartName -match "LocalSystem|Administrator") {
        Write-Host "    WARNING: Service runs with elevated privileges. Migrate to a least-privilege service account." -ForegroundColor Red
    }
}

# --- Step 3: Check for suspicious child processes of pc-app.exe (live triage) ---
$pcProc = Get-Process -Name "pc-app" -ErrorAction SilentlyContinue
if ($pcProc) {
    Write-Host "[+] pc-app.exe running (PID: $($pcProc.Id)). Check process tree in your EDR for anomalous children." -ForegroundColor Yellow
}

# --- Step 4: Verify internet exposure (PaperCut web ports should NOT be internet-facing) ---
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -in 9191, 9192, 9193 } |
    Select-Object LocalAddress, LocalPort -Unique
if ($listeners) {
    Write-Host "[+] PaperCut web listeners detected:" -ForegroundColor Yellow
    $listeners | Format-Table -AutoSize
    Write-Host "    Verify these are bound to internal interfaces and blocked at the perimeter firewall." -ForegroundColor Yellow
}

# --- Step 5: Enable Windows Firewall restriction to internal subnets only (example) ---
# Adjust -RemoteAddress to your internal ranges before running
# New-NetFirewallRule -DisplayName "PaperCut Web - Internal Only" -Direction Inbound `
#   -LocalPort 9191,9192 -Protocol TCP -RemoteAddress 10.0.0.0/8,192.168.0.0/16 -Action Allow

Write-Host "`n[+] Assessment complete. Patch first, then hunt — assume any long-unpatched server has been probed." -ForegroundColor Cyan