Exposed Files Reveal PaperCut Exploitation, a Second RCE Path and Attacker Tooling

Oct 15, 2026 · Original article ↗

Summary

Researchers analyzed exposed attacker directories tied to a PaperCut campaign, uncovering a second XML-RPC RCE path, credential theft and persistent SOCKS5 pivots. Actor files documented 1,005 hosts across 45+ countries and 45 live pivots.

Key points

Three exposed directories on 45.142.193[.]132 contained exploit code, AI-agent instructions, operational logs and post-exploitation artifacts.
The tooling showed a second RCE path through PaperCut XML-RPC configuration calls when API access controls were weak, separate from the Tapestry vulnerability chain.
Post-exploitation tools collected Windows LSA secrets and service credentials, pivoted into internal networks, and packaged compromised hosts for reuse.
Linux scripts used chisel and cron to maintain reverse SOCKS5 access through compromised systems.
Recovered actor files listed 1,005 reconnaissance targets across at least 45 countries, 46 Active Directory domains and 45 targets with live reverse SOCKS5 pivots.
The researchers recommend patching PaperCut, restricting management and XML-RPC access, investigating for compromise, and hunting for the described persistence and behavioral indicators.

Article Details

Attack Vectors: Exploitation of internet-facing print-management servers through an unauthenticated Tapestry access bypass chained with unsafe JDBC driver loading.
An alternative XML-RPC configuration-write path, documented in the operator's tests, enabled code execution when API network and authentication controls were weak. This path did not depend on the Tapestry bypass.
Version-specific execution used H2 INIT with inline Groovy on 26.x targets or Apache Derby export functionality to write attacker-controlled class files on earlier versions.
Post-exploitation collectors recovered Windows machine-account secrets and searched application configuration and logs for database, LDAP, keystore, and service-account credentials.
Compromised servers became internal-network pivots through Java bridges and reverse SOCKS5 tunnels. Linux deployments maintained tunnel access through cron and a process-monitoring script.
Automated follow-on activity created local administrator accounts, modified existing administrator access and security policies, enumerated internal systems, and packaged credentials and reusable access configurations.
Defensive Notes: Upgrade affected installations to 26.0.5, 25.0.13, 24.1.10, or later. Investigate previously exposed, unpatched systems rather than treating patching alone as sufficient.
Remove unnecessary Internet exposure from administrative interfaces and restrict servers' access to internal network resources.
Disable /rpc/api/xmlrpc if unnecessary; otherwise enforce explicit API authentication and network allowlists instead of relying on the administrator-password fallback.
Review user-lookup.* configuration changes, unexpected class files in the installation, and transient output files under custom/web/. The web-output variant deleted its output after 30 seconds.
Hunt for /var/tmp/.rs_live46_v5, unfamiliar watch.sh scripts, periodic and @reboot cron entries, process-monitoring commands, and unusual long-lived outbound TLS connections.
After confirmed compromise, investigate Windows SECURITY and SYSTEM hive collection and rotate credentials accessible to the service account, including application and directory-service secrets.
Investigate unauthorized account creation, privilege changes, abnormal domain enumeration, and suspicious authentication originating from compromised servers.
Apply outbound traffic restrictions and behavioral detection alongside static indicators. The researchers found that generic TLS fingerprints and the shared certificate issuer did not reliably identify other operator infrastructure.

Indicators of compromise

Type	Indicator	Context
IPV4	`45[.]142[.]193[.]132`	Primary attacker orchestration host exposing exploit tooling and post-exploitation artifacts on ports 8000, 18080, and 18081; also received reverse tunnels on port 18443.
IPV4	`45[.]158[.]196[.]75`	Identified in the article's IOC table as the operator's secondary build and execution VPS, reached over SSH.
MD5	`528cd4e69ecfa5191adbcf6ef28667bf`	Hash of lsa_read.exe, the Rust LSA secret reader recovered from the operator's tooling.
MD5	`a6437ac3d6798090a218520985d36a3f`	Hash of collect_custom.exe, the recovered collector for LSA-related data and host/domain information.
MD5	`ce870a91e8d27e8f663f0687abc60b04`	Hash of save_hives.exe, the recovered registry hive dumper used to export SECURITY and SYSTEM hives.
MD5	`fc92dfafa7aa741c5f2b9cbcf75d1d19`	Hash of lsa_collect_small.exe, identified as a Rust LSA bootkey collector in the operator's exposed files.