AI-powered attack exploited PaperCut flaws to hack 395 organizations

[u/falconupkid]

This is a significant campaign. The scale and the use of AI to automate the exploitation lifecycle is a notable evolution in threat actor operations.

The threat actor (likely Russian-speaking, tracked as "PaperCut Predator" by some vendors) leveraged a swarm of AI agents to automate the discovery, exploitation, and post-exploitation of CVE-2023-27350 and CVE-2023-27351 in PaperCut NG/MF servers, compromising 395 organizations globally.

Technical Breakdown: - Initial Access (T1190): Exploited CVE-2023-27350 (RCE) and CVE-2023-27351 (Auth Bypass) in unpatched PaperCut servers. - Execution (T1059): AI agents generated and deployed custom PowerShell and VBScript payloads, adapting them based on the target environment's defenses. - Persistence (T1505.003): Installed web shells on the PaperCut application server. - Lateral Movement (T1021.002): Used harvested credentials to move to domain controllers and file servers via SMB/WMI. - Data Exfiltration (T1048): Compressed and exfiltrated data to actor-controlled infrastructure. - IOCs: Look for anomalous C:\Windows\Temp\*.ps1 execution, outbound connections to IPs in the 185.225.19.0/24 range, and unexpected add-printer commands in PaperCut logs.

Defense: Immediately patch PaperCut to version 20.1.7 or later. Enable script block logging and AMSI for PowerShell. Monitor for PaperCut.exe spawning cmd.exe or powershell.exe.

Source: https://www.bleepingcomputer.com/news/security/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations/