AI-Assisted PaperCut Attacks Expose a Second RCE and Global Victim Network

Summary

A Russian-speaking threat actor carried out a targeted campaign against Ukrainian infrastructure, with a particular focus on the data-exchange ecosystem and Graylog logging servers. The attacker used a Log4Shell-based JNDI injection chain to achieve remote code execution and deploy reverse shells. Although multiple exploits were attempted against MikroTik and Fortinet systems, the primary successful access relied on a reusable CommonsBeanutils2 deserialization chain.

Investigation

The investigation began after researchers discovered an operator staging directory exposed on a public IP address for approximately 17 hours. Analysts recovered the attacker’s working files, including exploit scripts, payload builders, shell history, and reconnaissance output. This exposure made it possible to reconstruct the full attack chain, from initial masscan reconnaissance to successful code execution on Graylog instances.

Mitigation

Organizations should prioritize patching Graylog deployments and ensure JNDI lookups are disabled or tightly restricted through appropriate Java security controls. Strict egress filtering should be enforced to block unauthorized LDAP and RMI connections from application servers. Security teams should also monitor for unusual child processes spawned by Java-based services and enforce CSRF protections on sensitive API endpoints.

Response

When suspicious JNDI activity or unexpected child processes originating from web services are detected, isolate the affected host immediately. Review application logs for successful exploitation patterns, with particular attention to the /api/system/sessions endpoint. Conduct host-level forensic analysis for unauthorized SSH keys, reverse shells, or persistent tunnels that may have been used for pivoting.

Simulation Execution

• Attack Narrative & Commands: The adversary is attempting to exploit a vulnerability in a state-exchange web application. To blend in with administrative traffic, they use a specific header X-Requested-By: cli. They target the session management endpoint /api/system/sessions and attempt to trigger the execution of a malicious shell script named fire3.sh. The presence of the UXP Verifier string in the response is a known characteristic of the specific toolkit used by this threat actor. The goal is to gain remote code execution via the web server.

• Regression Test Script:

  #!/bin/bash
  # Simulation script to trigger the detection rule
  # This simulates a request that matches all four detection criteria
  
  TARGET_URL="http://localhost/api/system/sessions"
  
  echo "[+] Simulating targeted attack request..."
  
  # We use curl to mimic the exact headers and request path.
  # Note: Since we cannot easily control the 'ResponseBody' of a real server 
  # without hosting a mock server, this simulation assumes the logs are 
  # generated by an intercepting proxy or a mock web service that 
  # returns 'UXP Verifier'.
  
  curl -X POST "$TARGET_URL" 
       -H "X-Requested-By: cli" 
       -H "Content-Type: application/json" 
       -d '{"filename": "fire3.sh", "payload": "echo "UXP Verifier""}' 
       --verbose
  
  echo "[+] Simulation command sent."

• Cleanup Commands:

  # No persistent changes made to the system, but if a mock server was started:
  # pkill -f "python3 -m http.server"
  echo "[+] Cleanup complete."