Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

Summary

A likely Russian-speaking threat actor is using AI agents powered by OpenAI Codex and DeepSeek to coordinate a global cyber campaign. The adversary exploits vulnerabilities in PaperCut NG/MF print management software to achieve remote code execution and ultimately obtain domain administrator privileges. The operation has compromised hundreds of organizations across dozens of countries through highly automated attack workflows.

Investigation

GreyNoise used its Global Observation Grid to monitor the adversary’s infrastructure and tradecraft without relying on victim reports. The investigation found that the actor leveraged internet scanning services such as Netlas.io to build target lists and used AI to accelerate the attack lifecycle from initial access to domain dominance. Researchers identified attack paths involving LSA memory harvesting, noPac attacks, and DCSync.

Mitigation

Organizations should prioritize patching PaperCut NG/MF against known vulnerabilities and strengthen Active Directory security. Deploying foundational protections such as WAFs can help block initial exploitation attempts. Defenders should also restrict unnecessary SYSTEM-level privileges and monitor for unauthorized registry hive dumping, suspicious LSA access, and other credential harvesting activity.

Response

If malicious activity is detected, incident responders should immediately isolate compromised PaperCut hosts and investigate lateral movement involving DCSync or pass-the-hash. Teams should search for unauthorized accounts such as Administrator17 and staged registry hives in C:\Windows\Temp or C:\ProgramData. Recent Domain Admin group changes should also be audited, along with any unauthorized tunneling tools such as Ligolo-ng.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The attacker has gained initial access to a workstation. To escalate privileges or move laterally, they need to extract local credentials. They execute a PowerShell command to dump the SYSTEM and SECURITY hives to the local C:Temp directory using reg save. Once the hives are dumped, they attempt to evade network-based Data Loss Prevention (DLP) by encoding the registry files into Base64 format using certutil.exe. This mimics an adversary attempting to hide sensitive data within a seemingly innocuous text file before exfiltration.

• Regression Test Script:

  # Simulation Script: Registry Hive Dumping and Certutil Encoding
  $ErrorActionPreference = "SilentlyContinue"
  
  # 1. Create a temporary directory for the artifacts
  $workDir = "C:WindowsTempSimTest"
  if (!(Test-Path $workDir)) { New-Item -ItemType Directory -Path $workDir }
  
  Write-Host "[*] Starting Simulation: Dumping Registry Hives..."
  
  # 2. Trigger 'selection_reg_save' and 'selection_hives'
  # This command targets the detection logic: reg save + HKLMSYSTEM
  reg save HKLMSYSTEM "$workDirsystem_dump.hiv"
  reg save HKLMSECURITY "$workDirsecurity_dump.hiv"
  
  Write-Host "[*] Hives dumped. Triggering 'selection_certutil_encode'..."
  
  # 3. Trigger 'selection_certutil_encode'
  # This command targets the detection logic: certutil.exe + -encode
  certutil.exe -encode "$workDirsystem_dump.hiv" "$workDirsystem_dump.txt"
  
  Write-Host "[+] Simulation complete. Check your SIEM for alerts."

• Cleanup Commands:

  # Cleanup Script: Remove simulation artifacts
  $workDir = "C:WindowsTempSimTest"
  if (Test-Path $workDir) {
      Remove-Item -Recurse -Force $workDir
      Write-Host "[+] Cleanup successful: $workDir removed."
  } else {
      Write-Host "[-] Cleanup failed: Directory not found."
  }