Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Attackers are exploiting vulnerabilities in PaperCut servers to steal credentials and gain access to sensitive data within schools and universities across the U.S. and Europe. The attackers are leveraging these flaws to conduct reconnaissance, create privileged accounts, and ultimately compromise other systems within the network.
Threat actors are exploiting newly disclosed vulnerabilities in PaperCut servers to facilitate credential theft and broader system compromise within the education sector. The Arctic Wolf Adversary Research Team observed attackers utilizing CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct reconnaissance, create privileged accounts, and establish a foothold within targeted environments.
Observed post-exploitation activity included the deployment of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitive configuration data. The cybersecurity company told The Hacker News that the activity has targeted vulnerable PaperCut servers across the education sector, impacting organizations ranging from K-12 schools to major universities in the U.S. and Europe.
Some of the identified malicious activity includes -
- Running discovery commands like uname, whoami, ver, and tasklist, and privileged account creation ("Administrator17")
- Inbound GET requests from "45.142.193[.]132" that request for "/custom/pcp_*.txt" and "/custom/web/pcp_*.txt" files on compromised hosts, containing harvested system and user data
- Deliver credential-harvesting tools like lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe via "certutil.exe" from "45.142.193[.]132"
- Retrieve Meterpreter Java payloads from, and establish sessions to, "194.180.48[.]134"
- Use "findstr" to search PaperCut *.config files for the terms "password," "secret," "ldap," "bind,v" and "token"
Arctic Wolf said it also detected "lsa_collect.exe" in a sandbox that extracted specific registry keys to reconstruct the system BootKey, which can then grant the attacker access to the SAM database. The concern is that those stolen logins could give attackers a pathway into other critical systems across the environment. Post-compromise activity included deployment of Windows registry.