Schools and universities are again facing a familiar problem: widely deployed infrastructure software is being turned into an entry point for credential theft. According to reporting on newly observed activity, attackers are exploiting two PaperCut flaws affecting education organizations in the United States and Europe. The campaign is notable not only because PaperCut servers are common in academic environments, but also because the reported post-exploitation behavior focuses on reconnaissance, privilege creation, registry hive collection, and searches for secrets in configuration files.

For security teams in K-12 districts, colleges, and universities, this should be treated as an urgent exposure-management and detection task. Print management systems often sit close to identity infrastructure, contain directory integration settings, and are easy to overlook when teams prioritize endpoints and student-facing applications. If a PaperCut server is reachable from the internet or has not been reviewed after the latest disclosures, it deserves immediate attention.

What is being exploited

The activity centers on CVE-2026-81578 and CVE-2026-82078, described in the source reporting as an authentication-bypass and remote-code-execution chain. In practical terms, that combination is dangerous: an attacker may be able to reach a vulnerable PaperCut instance, bypass normal access controls, and execute commands without first possessing valid administrative credentials.

Arctic Wolf researchers observed attackers using the access for command execution, environment discovery, and creation of privileged accounts. One reported account name was "Administrator17," a detail defenders can use as a quick hunting clue, though it should not be treated as the only possible account name. Once exploitation begins, operators appear to be trying to understand the host, identify users and processes, collect sensitive configuration data, and move toward credential material.

This pattern is consistent with a high-value initial access operation. Attackers do not need to immediately deploy ransomware or disrupt printing to create harm. A foothold on a print management server can provide passwords, tokens, directory binding secrets, or local credential databases that support later movement across the network.

Why education is a likely target

Education networks are attractive because they combine large user populations, mixed device ownership, complex identity systems, and tight IT budgets. PaperCut deployments may serve students, faculty, staff, libraries, labs, and administrative offices. They may also be integrated with LDAP or Active Directory to support user authentication, quota management, and print release workflows.

That integration is useful operationally, but it also raises the stakes during a compromise. If configuration files contain bind credentials, shared service-account passwords, tokens, or other secrets, an attacker who can read those files may gain access beyond the PaperCut host. Even if the PaperCut server itself is segmented, stolen credentials can become the bridge to domain resources, file shares, email, student information systems, or administrative applications.

Academic environments also have predictable windows of stress: term starts, registration periods, exams, and campus move-ins. Attackers often time exploitation around moments when IT teams are overloaded and service availability pressure is high.

Reported indicators and behaviors to hunt

Defenders should look for exploitation and post-exploitation activity rather than relying on patch state alone. The reported activity includes discovery commands such as uname, whoami, ver, and tasklist, along with command execution where pc-app.exe is the parent process. On Windows systems, execution of cmd.exe, powershell.exe, or other scripting interpreters from the PaperCut application context should be treated as suspicious unless there is a known administrative reason.

The report also describes inbound GET requests from 45.142.193[.]132 requesting paths similar to /custom/pcp_.txt and /custom/web/pcp_.txt. Those files reportedly contained harvested system and user data. Security teams should review web access logs, application logs, and endpoint telemetry for those path patterns as well as unexpected files created under PaperCut web-accessible directories.

Credential collection tooling is another key signal. Filenames reported in the activity include lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe, with delivery via certutil.exe from 45.142.193[.]132. Use of certutil.exe to download binaries is a common living-off-the-land technique and should be alert-worthy on servers that do not normally retrieve files that way.

Arctic Wolf also observed Meterpreter-related Java payload activity involving 194.180.48[.]134. Even if your controls do not have exact matches for that infrastructure, hunt for unusual outbound sessions from PaperCut servers, Java processes launched unexpectedly, and encoded or staged payload behavior.

Immediate containment and hardening steps

Start with exposure. PaperCut servers should not be directly exposed to the public internet unless there is a thoroughly justified and protected business requirement. Place access behind a VPN, identity-aware proxy, or administrative network boundary. If external access is required, restrict it to known source ranges and add monitoring for abnormal paths and commands.

Next, verify patch status and vendor guidance. Apply available fixes or mitigations for the affected PaperCut versions as soon as operationally possible. If patching must be delayed, reduce attack surface immediately by blocking external access, limiting administrative interfaces, and increasing logging around the application host.

Review local and domain accounts. Search for newly created privileged users, especially unusual administrator-like names. Validate service accounts used by PaperCut, rotate credentials that may be stored in configuration files, and check whether those accounts have more privilege than necessary. Directory bind accounts should generally have minimal read-only access, not broad administrative capability.

Preserve and inspect logs before rebuilding anything. Useful evidence may exist in PaperCut logs, web server logs, Windows event logs, EDR telemetry, proxy logs, and firewall records. Look for the command names, filenames, path patterns, and IP indicators listed above. If registry hive collection tools were executed, assume credential exposure is possible and expand the investigation to identity systems.

Practical response checklist

Prioritize these actions over the next 24 hours:

- Identify all PaperCut servers, including test, legacy, and department-managed systems.
- Confirm whether any instance is internet-accessible.
- Apply vendor patches or mitigations for CVE-2026-81578 and CVE-2026-82078.
- Hunt for pc-app.exe spawning shells, scripting tools, or discovery commands.
- Search for Administrator17 and any other unexpected privileged accounts.
- Review for lsa_collect.exe, lsa_collect_small.exe, save_hives.exe, and suspicious certutil.exe usage.
- Inspect PaperCut configuration files for stored secrets and rotate exposed credentials.
- Monitor for the reported defanged IP indicators and for unusual outbound Java or Meterpreter-like traffic.

The distinctive takeaway for campus defenders is simple: treat a PaperCut compromise as a credential incident, not merely a print-server issue. If attackers reached the application and collected secrets, the blast radius may extend into identity, file storage, and administrative systems.

Source: The Hacker News source