PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A cyber actor, believed to be Russian-speaking, has been using artificial intelligence to exploit recently disclosed security flaws in PaperCut NG/MF, compromising over 440 instances. The actor has been utilizing hundreds of AI agents to carry out the attacks. The malicious activity is traced back to a specific IP address, 45.142.193.132, which has been linked to the actor. This IP address has been identified by independent reports from Blackpoint Cyber and GreyNoise as the origin of the attacks. The use of AI in these attacks is a notable aspect of the campaign.