Threat actors are actively exploiting two newly disclosed PaperCut vulnerabilities, CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution), in a chained attack targeting educational institutions in the U.S. and Europe. The Arctic Wolf Adversary Research Team observed attackers leveraging this exploit chain to perform command execution, reconnaissance, and credential theft. The education sector appears to be the primary target of this campaign. The attack chain combines an authentication bypass with remote code execution, making it particularly dangerous. Organizations using PaperCut print management software are urged to patch immediately.
Threat actors are exploiting two PaperCut vulnerabilities chained together: CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution). The attack chain enables command execution, reconnaissance, and privileged account creation. Post-exploitation activity includes delivery of Windows registry hive collection tools (lsa_collect.exe, lsa_collect_small.exe, save_hives.exe) via certutil.exe from a malicious IP, Metasploit/Meterpreter Java payloads, and discovery commands (uname, whoami, ver, tasklist). Attackers also use findstr to search PaperCut *.config files for sensitive terms like 'password', 'secret', 'ldap', 'bind', and 'token'. The tool lsa_collect.exe extracts specific registry keys to reconstruct the system BootKey, granting access to the SAM database for credential harvesting. Inbound GET requests were observed requesting '/custom/pcp_*.txt' and '/custom/web/pcp_*.txt' files containing harvested system and user data. Attacks target the education sector including K-12 schools and universities in the U.S. and Europe.
1. Restrict PaperCut servers from being exposed to the internet. 2. Monitor for execution of cmd.exe, powershell.exe, or other scripting and command interpreters with pc-app.exe as the parent process. 3. Monitor for commands containing whoami, tasklist, ver, or uname -a with pc-app.exe as the parent process. 4. Block or monitor connections to malicious IPs 45.142.193[.]132 and 194.180.48[.]134. 5. Monitor for creation of unauthorized privileged accounts. 6. Scan for presence of credential-harvesting tools lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe. 7. Monitor inbound GET requests for '/custom/pcp_*.txt' and '/custom/web/pcp_*.txt' files. 8. Apply available patches for CVE-2026-81578 and CVE-2026-82078.
45.142.193[.]132, 194.180.48[.]134, lsa_collect.exe, lsa_collect_small.exe, save_hives.exe, /custom/pcp_*.txt, /custom/web/pcp_*.txt, Administrator17 (privileged account name created by attacker)
