PaperCut CVE-2026-81578/82078 Chain Enables BootKey Extraction in US/EU Education Networks
Active exploitation of two PaperCut CVEs targets education sector for credential theft via BootKey and config scraping. Arctic Wolf telemetry shows consistent tooling and infrastructure but no state attribution. Risk centers on downstream pivots into school AD environments.
Attackers chained CVE-2026-81578 and CVE-2026-82078 to execute discovery commands, create accounts such as Administrator17, and harvest registry hives. Post-exploitation focused on pc-app.exe spawning whoami, tasklist, and findstr searches for LDAP bind credentials and tokens inside .config files. The same infrastructure staged save_hives.exe and Java Meterpreter sessions to 194.180.48[.]134. Evidence consists of Arctic Wolf sandbox detonations confirming BootKey reconstruction from SAM, inbound GET requests for /custom/pcp_.txt files containing exfiltrated data, and certutil downloads from the listed IPs. No independent packet captures or victim telemetry have been published. Education environments maintain large fleets of internet-exposed PaperCut instances with delayed patching cycles. The observed focus on credential material rather than ransomware suggests preparation for lateral movement into Active Directory or student information systems. This matches prior patterns where print-management software served as an initial foothold before broader domain compromise. Organizations should isolate PaperCut servers, block the two IPs, and monitor for registry collection binaries. Unpatched instances will remain viable entry points until widespread deployment of vendor fixes.
Arctic Wolf: At least 30 percent of publicly indexed PaperCut servers will exhibit lsa_collect.exe execution within 45 days.
Sources (2)
- [1]Arctic Wolf Adversary Research Team report(https://arcticwolf.com/resources/research/papercut-exploitation-2026)
- [2]The Hacker News coverage(https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html)