Hackers Turned a PaperCut Print Server Into a Path to the Domain Controller

A vulnerable print server became the entry point for an Active Directory compromise after attackers exploited two PaperCut MF zero-day flaws.

The intrusion shows how an overlooked business system can give criminals access to sensitive identity infrastructure. The attackers targeted an internet-facing PaperCut MF server running version 24.0.2, build 69746.

They delivered Java code through the card or ID lookup field, installed an in-memory loader and web shell, used that foothold to deploy an AdaptixC2 implant hidden inside a modified Microsoft Copilot binary.

eSentire said in a report shared with Cyber Security News (CSN) that its analysts detected the intrusion on August 31, 2026, at an education-sector customer. Its analysts found that the attackers moved from the print server to a domain controller in less than two days.

The case underlines the danger of leaving management applications exposed online. It follows reports that the PaperCut flaws were actively exploited, with defenders warned to restrict public access and watch for suspicious activity from the service.

Hackers Turned a PaperCut Print Server

The initial compromise relied on CVE-2026-81578 and CVE-2026-82078, a pair of vulnerabilities that can be chained to alter settings without authentication and run malicious Java bytecode in the PaperCut server’s security context.

Earlier coverage of the actively exploited PaperCut flaws explains why internet-facing application servers need urgent attention. The first-stage loader was designed for broad compatibility across different Tomcat releases.

It rebuilt payload fragments in memory, started the next stage, and removed its own files. The web shell then accepted instructions through a custom HTTP header, ran commands, read configuration values, and deleted traces from logs and the internal application database.

That cleanup mattered. The web shell also placed itself early in the server’s request-processing chain and blocked unrelated attempts to use the same weakness. In effect, the attackers tried to preserve exclusive control while making the original break-in harder to investigate.

The modified binary established contact with remote attacker infrastructure, then remained quiet for roughly a day. Operators then returned for hands-on activity, illustrating how attackers use open-source command-and-control attack frameworks to expand access after breaching a vulnerable server.

Credential Theft

Once active, the attackers surveyed hosts, networks, domain trusts, and administrator groups. They identified a process running under a domain-privileged service account, copied its access token, and relaunched the implant with that account’s rights.

No stolen administrator password was needed to begin the move toward the domain controller. Using those privileges, the group copied its payload to the domain controller through an administrative file share.

It then temporarily changed the Windows PlugPlay service configuration to start the payload, stopped the service after launch, and restored the legitimate service path.

That sequence allowed execution while reducing evidence of the change. On the domain controller, the attackers dumped credentials from memory and the registry.

They enabled Windows Restricted Admin mode, used a recovered NTLM hash to sign in over Remote Desktop Protocol, and created a copy of the Active Directory database.

That database can contain password hashes for every domain account, creating a serious risk of further pass-the-hash movement. The attackers packaged the database and supporting registry data into an archive for exfiltration.

Their customized implant used encrypted settings and scrambled program logic to hinder analysis. Public sandboxes also failed to run the modified binary when its legitimate supporting library was missing.

Administrators should update PaperCut MF or NG to the latest release and allow only trusted IP addresses to reach its application servers.

They should monitor child processes of the PaperCut service, missing or unexpectedly shortened server logs, and unusual post-exploitation behavior. Recent reporting on emergency PaperCut security updates also highlights the need to apply vendor fixes without delay.

Security teams should review the vendor advisory’s indicators, look for the log errors identified by the researchers, and investigate unexpected changes to service configurations.

Researchers also recommend reducing service-account permissions and maintaining endpoint monitoring. eSentire isolated the affected host and helped the customer with remediation following the intrusion.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC