Attackers Exploit PaperCut Zero-Days to Install Remote Access Tools
Summary
PaperCut says attackers exploited two zero-days in NG and MF servers to install SimpleHelp and AnyDesk. Emergency patches are available; customers are urged to restrict access, preserve evidence, review logs, and rebuild suspected compromised servers.
Key points
- The campaign targets internet-facing PaperCut NG and MF Application Servers, exploiting CVE-2026-81578 and CVE-2026-82078 for unauthenticated access and code execution.
- PaperCut says attackers enumerated users, processes, domain controllers, and logged-on sessions after gaining access.
- Observed activity included installing SimpleHelp for persistent remote access and downloading AnyDesk as a second access channel.
- PaperCut released emergency patches on August 28, including a second update with additional hardening; customers should update all affected server components.
- PaperCut advises restricting web access to trusted IPs, preserving forensic evidence, reviewing logs, and wiping and rebuilding servers if compromise is suspected.
- Huntress found exploitation in two customer environments; it reported that 47% of about 2,500 installations it tracks were running v23 or older, for which no patch was then available.
Article Details
- Event Type
- Exploitation of two zero-day vulnerabilities in PaperCut NG and MF, followed by deployment of remote access software.
- Impact
- The vulnerabilities enabled unauthenticated access, authentication bypass, system configuration changes, and arbitrary Java bytecode execution on internet-facing PaperCut Application Servers. Attackers were observed installing SimpleHelp and AnyDesk for remote access. The attackers’ ultimate goal is unknown.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sendit[.]sh | Host used by attackers to download a malicious payload to compromised PaperCut Application Servers. |
MITRE ATT&CK
T1018 · Remote System DiscoveryAttackers enumerated domain controllers.T1033 · System Owner/User DiscoveryAttackers ran whoami to identify the current user.T1057 · Process DiscoveryAttackers listed running processes.T1059.003 · Windows Command ShellObserved activity included launching cmd.exe shell processes.T1069 · Permission Groups DiscoveryAttackers listed user privileges.T1082 · System Information DiscoveryAttackers ran ver to retrieve system version information.T1087 · Account DiscoveryAttackers listed users.T1105 · Ingress Tool TransferAttackers downloaded a malicious payload and AnyDesk to compromised servers.T1190 · Exploit Public-Facing ApplicationAttackers exploited zero-day vulnerabilities in internet-facing PaperCut Application Servers.T1219 · Remote Access ToolsAttackers installed SimpleHelp and AnyDesk to establish remote access.
CVE
Vendors
Products
AnyDeskApplication Servers and covertly install legitimate remote access tools such as SimpleHelp and AnyDesk.PaperCut MFCVE-2026-81578, an improper access control vulnerability in the web management interface of PaperCut MF and PaperCut NGPaperCut NGPaperCut says a threat actor is exploiting two zero-day vulnerabilities in PaperCut NG and MF to gain access to internet-facing Application Servers and covertly install legitimate remote access tools such as SimpleHelpSimpleHelpto internet-facing Application Servers and covertly install legitimate remote access tools such as SimpleHelp and AnyDesk.