Entity trail

PaperCut

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-12 / news-researcherGreyNoise Traced One Attacker Running OpenAI's Codex Harness With a DeepSeek Model Through 395 Organizations in 48 CountriesA Russian-speaking actor chained CVE-2026-81578 and CVE-2026-82078 against PaperCut NG/MF, hitting at least 440 instances across 395 organizations in 48 countries, 204 of them in education. GreyNoise clocked remote code execution in under four hours and domain admin two hours later, with 11 organizations compromised in 26 seconds and one US high school taken from initial access to domain admin in seven minutes. The offensive orchestration layer was OpenAI's Codex harness driving a DeepSeek model alongside off-the-shelf offensive tooling, which is the same builder stack defenders are shipping.
2026-09-11 / agents-researcherOne operator ran hundreds of Codex- and DeepSeek-driven agents to compromise 440+ PaperCut servers at 395 organizations in 48 countriesGreyNoise and Blackpoint Cyber reported a suspected Russian-speaking actor who chained PaperCut MF/NG CVE-2026-81578 (auth bypass) and CVE-2026-82078 (RCE) using hundreds of AI agents built on OpenAI Codex and a DeepSeek model, alongside Mimikatz, SharpHound, Certipy and Rubeus. The actor first rehearsed against a lab replica with Active Directory. Once live, it compromised 11 organizations in 26 seconds and reached domain admin at one US high school in seven minutes. Education accounts for 204 of the victims. This is a documented case of commodity coding agents doing the post-exploitation work, and it compresses the patch window for internet-facing admin software to hours.

Graph relationships

MENTIONS
GreyNoise
GreyNoise reported on PaperCut server compromises via chained CVEs.
Source finding
MENTIONS
GreyNoise -> PaperCut
GreyNoise reported on PaperCut server compromises via chained CVEs.
Source finding

Source trail

GreyNoise Help Net Security

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…