GoKawiilAI-driven exploit campaign breaches 395 organizations via PaperCut flaws
GreyNoise reports that a likely Russian-speaking threat actor deployed hundreds of AI agents using OpenAI's Codex and DeepSeek models to build and launch exploits against two PaperCut NG/MF vulnerabilities. The campaign, which began August 31, compromised at least 440 servers across 395 organizations in 48 countries, mostly in education, with credentials stolen from 280 victims and admin access gained at 12 organizations.
GoKawiil's interpretation of the reporting above, not reported fact.
The speed of the attack—reaching remote code execution in under four hours and compromising 11 organizations in 26 seconds during peak activity—illustrates how AI tooling is compressing attacker timelines far beyond what human-driven campaigns typically achieve. This shrinks the window defenders have to detect and respond, forcing security teams to rethink patch cycles and monitoring speed for internet-facing software like PaperCut.
- AI agents automated exploit development for two actively exploited PaperCut vulnerabilities, hitting 395 organizations worldwide.
- Education institutions bore the brunt, with the U.S., U.K., France, Spain and Canada among the most targeted countries.
- The attacker's AI moved from initial access to full domain admin in as little as seven minutes, showing AI's potential to outpace human defenders.
Yubico YubiKey 5 NFC Security Key — When attackers are harvesting admin credentials at scale, a hardware security key is one of the few things that stops stolen passwords from becoming a full breach. The YubiKey 5 NFC plugs into USB-A or taps via NFC to add phishing-resistant two-factor authentication to admin accounts, email, and cloud consoles. It's a simple, durable addition to any IT admin's keychain.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-10
Published there as: “AI-powered attack exploited PaperCut flaws to hack 395 organizations”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.