Act
active
Russian Actor Uses AI Agents to Compromise 440+ PaperCut Instances
- Engineer — Act: Active exploitation of recently disclosed PaperCut NG/MF flaws at scale — patch PaperCut to the latest version immediately and audit instances for IOC 45.142.193[.]132 in access logs.
- SOC/IR — Act: Multi-source-corroborated (Blackpoint Cyber + GreyNoise) campaign with a concrete IOC: sweep for 45.142.193[.]132 across network and proxy logs, and run an assume-breach hunt on any PaperCut NG/MF hosts in your estate.
- Leader — Act: 440+ compromised PaperCut instances attributed to a Russian-speaking actor is board-relevant scale — confirm whether PaperCut NG/MF is in your environment and verify patching status before this surfaces in news cycles.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.