Critical PaperCut NG/MF Vulnerability Under Active Exploitation PaperCut Software has issued an urgent warning about an unpatched vulnerability in its PaperCut NG and PaperCut MF print management solutions, which is being actively exploited in the wild. The company confirmed customer incidents and is prioritizing the investigation, though specific details including indicators of compromise (IoCs) remain undisclosed. What is PaperCut NG/MF? - PaperCut NG is a print management tool for offices, schools, and organizations, monitoring and controlling printing from computers and servers. - PaperCut MF is an enhanced version designed for multi-function office copiers (print, scan, fax), integrating directly with devices from major brands via touchscreen interfaces. Both versions rely on a central Application Server, typically one per organization, which acts as the system’s core. The Vulnerability & Exploitation Risk The flaw appears to be remotely exploitable, prompting PaperCut to urge immediate action: restrict public internet access to the Application Server, limiting connections to trusted internal IP addresses only. While the vendor has not yet released technical specifics, it advised users to monitor for signs of compromise, including: - Security alerts from intrusion detection, endpoint protection, or network monitoring tools particularly suspicious activity linked to pc-app.exe. - Missing, truncated, or deleted server.log files. - Error logs containing: - `ERROR No suitable driver found for jdbc:no:x` - `ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST` Even without detected anomalies, organizations should enforce firewall rules or network access controls to block untrusted external access to the server’s web interfaces. Historical Context & Threat Landscape This is not the first time PaperCut vulnerabilities have drawn attacker attention. In 2023, Clop and LockBit ransomware affiliates exploited two known flaws CVE-2023-27350 (remote code execution) and CVE-2023-27351 (information disclosure) to breach systems. The current incident underscores the ongoing targeting of print management software, a critical but often overlooked attack surface. PaperCut has committed to releasing further details as its investigation progresses. Organizations using affected versions are advised to follow the vendor’s mitigation guidance pending a patch.

Storm-1175: China-Based Cybercrime Group Exploits Zero-Days in High-Speed Ransomware Attacks Microsoft has identified Storm-1175, a financially motivated cybercriminal group based in China, as the force behind a series of high-velocity ransomware attacks leveraging zero-day and n-day exploits. The group, known for deploying Medusa ransomware, rapidly weaponizes newly disclosed vulnerabilities sometimes within 24 hours of discovery and, in some cases, a week before patches are released. Storm-1175’s attacks follow a streamlined playbook: initial access via unpatched flaws, followed by credential theft, security tool disablement, and ransomware deployment often within days. The group has targeted organizations in healthcare, education, professional services, and finance, with significant impacts in the U.S., U.K., and Australia. Recent campaigns have exploited over 16 vulnerabilities across 10 software products, including: - Microsoft Exchange (CVE-2023-21529) - PaperCut (CVE-2023-27351, CVE-2023-27350) - Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887) - ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708) - JetBrains TeamCity (CVE-2024-27198, CVE-2024-27199) - SmarterMail (CVE-2026-23760, CVE-2025-52691) - GoAnywhere MFT (CVE-2025-10035) In October 2024, Microsoft reported Storm-1175 exploiting CVE-2025-10035 (GoAnywhere MFT) before a patch was available. The group has also chained exploits to create persistence, deploy remote monitoring tools, and exfiltrate data before encrypting systems. A March 2025 advisory from CISA, the FBI, and MS-ISAC warned that Medusa ransomware attacks had compromised over 300 U.S. critical infrastructure organizations. Microsoft previously linked Storm-1175 to Black Basta and Akira ransomware campaigns exploiting a VMware ESXi flaw in July 2024. The group’s rapid exploitation of zero-days suggests either advanced in-house capabilities or access to exploit brokers, though many attacks still rely on known (n-day) vulnerabilities. Their tactics highlight the growing threat of high-speed, financially driven cybercrime operations.

AI-Powered PaperCut Exploitation Campaign Uncovered, Revealing Second RCE Vulnerability A recently exposed attacker toolkit has shed light on an advanced campaign exploiting PaperCut servers, leveraging AI-driven automation and uncovering a second remote code execution (RCE) vulnerability via its XML-RPC API. The operation extended beyond initial server compromise, enabling credential theft, internal network access, and persistent tunneling through SOCKS5 proxies. ### Key Findings & Attack Infrastructure Security researchers at Hunt.io discovered three open directories on the IP 45.142.193[.]132 (ports 8000, 18080, 18081), containing: - Exploit scripts targeting PaperCut vulnerabilities - AI agent instructions (in Russian and English) using OpenAI’s Codex with DeepSeek models - Operational logs documenting automated testing, debugging, and retries - Windows credential collectors (SECURITY/SYSTEM registry hives, machine-account secrets) - Packaged victim environments (3.9 GB across 1,924 files, 97 subdirectories) The toolkit revealed 45 active reverse SOCKS5 pivots and 46 distinct Active Directory domains in victim archives. Additionally, 2,165 logged Metasploit attempts yielded five confirmed interactive sessions, though these figures represent only a subset of the campaign’s impact. ### Second RCE Vulnerability via XML-RPC API The attacker’s workbench exposed a previously undisclosed RCE route through PaperCut’s /rpc/api/xmlrpc endpoint, bypassing the original Tapestry component exploit (CVE-2026-81578). The method relied on: - Weak API controls (accepting the built-in admin password as a fallback token) - Manipulation of user lookup settings via `api.setConfigValue` and `api.lookUpUserNameByCardNo` - Self-deleting temporary files (erased after 30 seconds) to evade detection ### Post-Exploitation Tactics After gaining access, the toolkit: - Collected Windows credentials (registry hives, service accounts) - Established SOCKS5 proxies for internal network access - Deployed Linux persistence via chisel tunnels and cron jobs - Reset configuration changes to minimize forensic traces ### Campaign Scope & Attribution Earlier research by GreyNoise and Blackpoint Cyber linked the campaign to 440 compromised PaperCut instances across 395 organizations in 48 countries. While Hunt.io’s findings focus on the attacker’s methods rather than breach counts, the exposed infrastructure (including a secondary VPS at 45.158.196[.]75) suggests a highly automated, AI-assisted operation. ### Indicators of Compromise (IOCs) - 45.142.193[.]132 – Primary orchestration server - 45.158.196[.]75 – Secondary build/execution VPS The discovery underscores the evolving sophistication of cybercriminal tooling, blending AI automation with traditional exploitation techniques to maximize persistence and lateral movement.

Storm-1175: Rapid Ransomware Deployment via Zero-Day and N-Day Exploits A Chinese-speaking cybercriminal group, Storm-1175, is accelerating its attacks, moving from initial access to full system compromise including Medusa ransomware deployment in as little as 24 hours, according to a new Microsoft report. Unlike state-sponsored actors, the group operates for financial gain, targeting healthcare, finance, education, and professional services sectors, primarily in the U.S., U.K., and Australia. Storm-1175 exploits a mix of zero-day and n-day vulnerabilities, often chaining flaws for maximum impact. The group has been observed abusing zero-days before public disclosure and rapidly weaponizing n-days leaving defenders minimal time to patch. Over 16 vulnerabilities across 10 products have been leveraged, including critical flaws in: - Microsoft Exchange (CVE-2023-21529) - PaperCut (CVE-2023-27351, CVE-2023-27350) - Ivanti Connect Secure/Policy Secure (CVE-2023-46805, CVE-2024-21887) - ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708) - JetBrains TeamCity, SimpleHelp, CrushFTP, SmarterMail, and BeyondTrust After gaining access, the group disables antivirus and endpoint protection, deploys tools for lateral movement and persistence, and exfiltrates data before encrypting systems with Medusa ransomware. Their high operational tempo and ability to identify exposed assets have made their attacks particularly effective.

CISA has issued an urgent warning regarding a critical vulnerability in PaperCut NG/MF print management software that threat actors are actively exploiting in ransomware campaigns. The vulnerability, tracked as CVE-2023-2533, represents a significant security risk to organizations worldwide using the affected software versions. This security flaw, categorized under CWE-352, allows attackers to potentially alter security settings and execute arbitrary code on vulnerable systems under specific conditions. The vulnerability’s severity stems from its ability to enable remote code execution (RCE), making it an attractive target for cybercriminals seeking to establish persistent access to enterprise networks.