PaperCut Flaws Exploited in Global Education Sector Attacks
Hackers chain vulnerabilities to steal credentials and create privileged accounts
1Active Exploitation in Education Sector
Attackers are actively exploiting two PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) to target schools and universities across the U.S. and Europe. Arctic Wolf researchers observed threat actors combining an authentication bypass with remote code execution capabilities. The attacks demonstrate how quickly disclosed vulnerabilities get weaponized, with PaperCut servers being compromised within days of flaw disclosure. Education institutions from K-12 schools to major universities have been impacted.
2Attack Methodology
Hackers chain the vulnerabilities to execute commands, perform reconnaissance, and create privileged accounts like 'Administrator17'. They deploy Windows registry collection tools and Meterpreter Java payloads to establish remote sessions. The attackers specifically search PaperCut configuration files for passwords, LDAP settings, and tokens. Post-exploitation activities include using lsa_collect.exe to extract registry keys for Windows BootKey recovery, potentially granting access to SAM database credentials.
3Malicious Tools Deployed
Attackers utilize multiple tools including Windows registry hive collectors and Metasploit/Meterpreter-related Java payloads. They download credential-harvesting tools using certutil and execute commands to identify system hosts, users, and processes. The lsa_collect.exe tool was observed extracting registry keys to reconstruct the system BootKey. This provides attackers potential access to stored credentials in the SAM database, creating pathways to other critical systems.
4Historical Context
PaperCut's print-management software has a history of security issues, including previous attacks delivering LockBit ransomware. The current vulnerabilities were disclosed by PaperCut on August 27, 2026, and added to CISA's Known Exploited Vulnerabilities catalog by August 31. This rapid weaponization timeline shows attackers' efficiency in converting disclosed flaws into operational attacks. The education sector appears particularly vulnerable to these print-management system exploits.
5Detection Indicators
Defenders should monitor PaperCut server.log files for exploitation signs and unusual five-character files (.class, .cmd, .out). Watch for command shells (cmd.exe, powershell.exe) spawned by pc-app.exe and suspicious commands (whoami, tasklist, ver). Check for unexpected privileged accounts, requests to /custom/pcp_*.txt, and large python-requests downloads. The creation of accounts like 'Administrator17' serves as a clear red flag for compromise.
6Defensive Recommendations
Organizations should restrict PaperCut servers from internet exposure and monitor for suspicious process activity. Special attention should go to pc-app.exe spawning command interpreters and execution of reconnaissance commands. Implement strict controls on privileged account creation and monitor for registry collection tools. Regularly review server logs for the identified IOCs and consider implementing network segmentation for print management systems.
7Broader Implications
These attacks highlight the risks of enterprise print-management systems as attack vectors. The rapid exploitation timeline (disclosure to attacks in days) underscores the shrinking window for patching. Compromised credentials from these systems can provide lateral movement opportunities across networks. The education sector's vulnerability suggests potential gaps in institutional cybersecurity postures regarding ancillary systems like print management.
8Critical Takeaways
The PaperCut exploitation demonstrates how attackers quickly weaponize new vulnerabilities, especially in commonly used enterprise software. Education institutions must prioritize patching these flaws and monitoring for associated IOCs. The attacks show sophisticated post-exploitation techniques targeting credential theft, emphasizing the need for robust credential management. This case serves as a warning about the security risks posed by seemingly mundane infrastructure components like print servers.
Original article: Security Affairs — PaperCut Flaws Exploited in Global Education Sector Attacks