Hunt.io: PaperCut attacker AI toolkit and second RCE path

Evidence record

Threat research analyzes observed exposed PaperCut attack artifacts, scripts and AGENTS.md operator instructions; observed remote status signals must not be counted as confirmed unique victims.

Read the original source ↗

Claim-level citations (5)

• supportsPaperCut attack artifacts show an AI-assisted intrusion workbench, not a count of confirmed victims: Hunt.io reports 2,165 logged exploit attempts and five confirmed interactive sessions; the 1,005 reconnaissance hosts in operator files are not all verified compromises.

  Telemetry breakdown for attempts, status and successful sessions

• supportsPaperCut attack artifacts show an AI-assisted intrusion workbench, not a count of confirmed victims: Observed attacker artifacts included an agent-style AGENTS.md and additional exploit scripts for PaperCut service attacks, showing an AI-assistant integration surface in a real attack toolkit.

  Tool/archive inventory and AGENTS.md screenshots

• supportsPaperCut attack artifacts show an AI-assisted intrusion workbench, not a count of confirmed victims: The recovered artifacts contain 45 targets with live reverse SOCKS5 pivots and 46 distinct Active Directory domains in packaged victim data; these are documented compromise indicators, separate from raw scanning attempts.

  Key Takeaways, victim data and campaign scale

• supportsPaperCut attack artifacts show an AI-assisted intrusion workbench, not a count of confirmed victims: The research describes an additional XML-RPC exploitation route separately from the initial PaperCut workflow rather than proving the same exploit occurred in every attempted request.

  Second RCE path and separate exploitation material

• supportsPaperCut attack artifacts show an AI-assisted intrusion workbench, not a count of confirmed victims: Hunt.io's attack-log table separately lists 2,165 requests, 13 status-ok results and five confirmed interactive sessions; those outcomes are not interchangeable with unique compromised organizations.

  Exploit log analysis table covering 44 files, attempt statuses and confirmed sessions