tag: Papercut · 7 items
- Engineer — Act: Two actively exploited flaws in PaperCut NG/MF now have proper maintenance releases; patch to version 26.0.5, 25.0.13, or 24.1.10 depending on your supported branch — emergency patches are superseded and these are the authoritative fixes.
- SOC/IR — Plan: Active exploitation is confirmed but the item provides no IOCs, TTPs, or detection signatures; plan to review PaperCut server logs and vendor advisory for exploitation indicators, and prepare a hunt query for abnormal print-server outbound connections once technical details surface.
- Leader — Plan: Active exploitation of widely deployed print-management software warrants confirming whether PaperCut is in your environment and ensuring the engineering team prioritizes patching this quarter; not a board-level systemic event but relevant if PaperCut is part of your estate.
- Engineer — Act: PaperCut NG/MF is being actively exploited at scale with hundreds of organizations confirmed compromised; patch PaperCut to the latest version immediately and audit server logs for exploitation indicators of compromise.
- SOC/IR — Act: This is an active, wide campaign — hunt for post-exploitation behavior on PaperCut servers (unusual process spawns, outbound connections from the print server) and expand scope to look for lateral movement from any PaperCut host since the campaign’s start date.
- Leader — Act: With 395 confirmed victims and a suspected nation-state-adjacent actor, confirm whether PaperCut NG/MF is in your environment, demand a patching and compromise-assessment status from engineering, and prepare a brief for leadership given the likelihood of press and customer questions.
- Engineer — Act: Active exploitation of recently disclosed PaperCut NG/MF flaws at scale — patch PaperCut to the latest version immediately and audit instances for IOC 45.142.193[.]132 in access logs.
- SOC/IR — Act: Multi-source-corroborated (Blackpoint Cyber + GreyNoise) campaign with a concrete IOC: sweep for 45.142.193[.]132 across network and proxy logs, and run an assume-breach hunt on any PaperCut NG/MF hosts in your estate.
- Leader — Act: 440+ compromised PaperCut instances attributed to a Russian-speaking actor is board-relevant scale — confirm whether PaperCut NG/MF is in your environment and verify patching status before this surfaces in news cycles.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation chaining an auth bypass into RCE. Identify your PaperCut version immediately and patch to the vendor-specified fixed release; treat as critical given the exploitation chain severity.
- SOC/IR — Act: An active credential-theft campaign is exploiting PaperCut installations, with command execution and reconnaissance observed. Hunt for post-authentication anomalies in PaperCut server logs and sweep for Arctic Wolf’s published IOCs dating back to the initial disclosure window.
- Leader — Plan: Verify whether PaperCut is deployed anywhere in your estate and confirm engineering is treating remediation as priority given CISA KEV listings and active credential harvesting; education-sector orgs face the highest exposure.
- Signals: CVE-2026-81578 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub · CVE-2026-82078 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: PaperCut NG and MF are actively exploited and the first fix was bypassed, meaning unpatched and initially-patched instances remain at risk; update to the latest emergency release immediately and verify the new version is applied end-to-end.
- SOC/IR — Plan: Active exploitation with a bypassed patch means print servers in the estate may already be compromised; build or tune detections for anomalous outbound connections and process spawning from PaperCut service accounts, and sweep logs back to the original disclosure date.
- Leader — Plan: If PaperCut is in the environment, confirm with engineering that the second emergency patch is deployed and request a status update — active exploitation plus a failed first fix is the kind of event that can escalate to a breach if patching is delayed.
- Engineer — Act: PaperCut NG and MF print management software is under active zero-day exploitation with confirmed customer incidents; apply PaperCut’s emergency patch for v25/v26 immediately and isolate unpatched instances from the network until patched.
- SOC/IR — Act: Confirmed active exploitation means assume-breach posture for any PaperCut server in the estate; sweep PaperCut application logs for anomalous requests and lateral movement indicators since PaperCut servers have been used as initial-access footholds in prior ransomware campaigns.
- Leader — Act: Active zero-day with confirmed customer incidents in widely deployed enterprise print software; this week confirm whether your organization runs PaperCut NG or MF, verify emergency patching is underway, and prepare a brief for leadership if exposure is confirmed.
- Engineer — Act: Unauthenticated RCE via chained flaws in PaperCut NG/MF is being actively exploited; apply the emergency patch immediately and audit PaperCut server logs for unexpected Java process execution or outbound connections predating the patch.
- SOC/IR — Act: Active exploitation of PaperCut print servers means assumed-breach posture is warranted — hunt for anomalous Java child processes or unusual network activity originating from PaperCut hosts since before the emergency patch date, and check EDR telemetry on any print-management systems.
- Leader — Plan: PaperCut NG/MF is common in enterprise and education environments; confirm with engineering that all instances are patched this week and verify no lateral movement occurred from print servers — prior PaperCut exploits (2023) drew board attention, so have a status update ready if asked.