Attackers Exploit PaperCut Flaws to Steal Credentials at Education Organizations
Summary
Arctic Wolf reports attackers exploiting PaperCut flaws CVE-2026-81578 and CVE-2026-82078 at U.S. and European education organizations to steal credentials, create privileged accounts, and deliver Meterpreter payloads.
Key points
- Arctic Wolf observed attackers chaining CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw, against vulnerable PaperCut servers.
- Targets included K-12 schools and universities in the U.S. and Europe.
- Observed activity included reconnaissance, privileged account creation, registry hive collection, and searches of PaperCut configuration files for sensitive data.
- Attackers used lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe for credential-harvesting activity, and delivered Meterpreter Java payloads.
- Arctic Wolf reported malicious activity involving 45[.]142[.]193[.]132 and 194[.]180[.]48[.]134.
- Recommended measures include restricting PaperCut servers’ internet exposure and monitoring for suspicious command interpreters and discovery commands.
Article Details
- Attack Vectors
- Attackers exploited CVE-2026-81578 and CVE-2026-82078 in a chain described as authentication bypass and remote code execution against exposed PaperCut servers.
- Attackers used certutil.exe to deliver credential-harvesting tools from 45.142.193[.]132.
- Attackers retrieved Meterpreter Java payloads from 194.180.48[.]134 and established sessions to that address.
- Post-exploitation activity included host and user discovery, privileged account creation, registry hive collection, and searches of PaperCut configuration files for sensitive values.
- Defensive Notes
- Restrict PaperCut servers from exposure to the internet.
- Monitor for cmd.exe, powershell.exe, and other scripting or command interpreters, especially when pc-app.exe is the parent process.
- Monitor for discovery commands including whoami, tasklist, ver, and uname -a.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 194[.]180[.]48[.]134 | Malicious host used to serve Meterpreter Java payloads and receive sessions. |
| IPV4 | 45[.]142[.]193[.]132 | Malicious host used to deliver credential-harvesting tools and send requests for harvested system and user data. |
MITRE ATT&CK
T1003.002 · Security Account Managerlsa_collect.exe extracted registry keys to reconstruct the BootKey and enable access to the SAM database.T1018 · Remote System DiscoveryDiscovery commands were used to identify hosts.T1033 · System Owner/User DiscoveryDiscovery commands included whoami to identify users.T1057 · Process DiscoveryAttackers ran tasklist to identify processes.T1059 · Command and Scripting InterpreterAttackers ran discovery commands and command interpreters on compromised servers.T1082 · System Information DiscoveryAttackers ran commands including ver and uname to collect system information.T1105 · Ingress Tool TransferCredential-harvesting tools and Meterpreter Java payloads were delivered to compromised servers.T1136.001 · Local AccountAttackers created a privileged account named Administrator17.T1190 · Exploit Public-Facing ApplicationAttackers exploited PaperCut vulnerabilities on internet-exposed servers.T1552.001 · Credentials In FilesAttackers searched PaperCut configuration files for passwords, secrets, LDAP binding data, and tokens.
CVE
CVE-2026-81578Threat actors are exploiting newly disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, to steal credentials and gain privileged access in attacks against education organizations in the U.S.CVE-2026-82078Threat actors are exploiting newly disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, to steal credentials and gain privileged access in attacks against education organizations in the U.S.
Vendors
Products
Tools
certutil.exeDeliver credential-harvesting tools like lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe via “certutil.exe” from “45.142.193[.]132” lsa_collect_small.exeDeliver credential-harvesting tools like lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe via “certutil.exe” from “45.142.193[.]132” lsa_collect.exeDeliver credential-harvesting tools like lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe via “certutil.exe” from “45.142.193[.]132” Metasploit Framework“Observed post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitiveMeterpreterArctic Wolf reported post-exploitation activity including reconnaissance, registry hive collection, Meterpreter payload delivery, and searches for sensitive configuration data on compromised servers.save_hives.exeDeliver credential-harvesting tools like lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe via “certutil.exe” from “45.142.193[.]132”