GoKawiilAI Agent Swarm Breached 440 PaperCut Servers in Hours, GreyNoise Finds
GreyNoise reports that a suspected Russian-speaking threat actor deployed hundreds of AI agents, trained in a lab, to hunt down internet-exposed PaperCut NG and MF servers and exploit two known vulnerabilities. The campaign hit at least 440 instances across 395 organizations in 48 countries, with attackers pivoting from initial compromise toward Windows Active Directory environments.
GoKawiil's interpretation of the reporting above, not reported fact.
The speed described—remote code execution in under four hours, domain admin two hours later, and 11 organizations compromised within 26 seconds once launched—shows how AI agents are compressing the traditional cyber kill chain from days to minutes. Combined with Google's recent warning about adversaries embedding agentic AI across attack stages, this signals defenders now face automated, self-directed attack swarms rather than solitary human operators, demanding equally automated detection and response.
- AI agents scanned, exploited, and pivoted across hundreds of PaperCut servers with minimal human oversight.
- The campaign compromised 11 organizations in just 26 seconds once fully launched.
- Security researchers warn this reflects a broader shift toward AI-driven automation at every stage of cyberattacks.
Ubiquiti UniFi Cloud Gateway Ultra — When automated AI-driven scanners can find and exploit an exposed server in seconds, keeping management software like PaperCut off the open Internet matters. The UniFi Cloud Gateway Ultra gives small teams real firewall and VPN control plus visibility into what's talking to the outside world, so internal services stay internal.
See Ubiquiti UniFi Cloud Gateway Ultra on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Robert Lemos, 2026-09-11
Published there as: “Papercut AI Swarm Attack Heralds Changes for Cyber Kill Chain”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.