Unmasking the PaperCut Attack: How Hackers Weaponized Zero-Days to Deploy RATs

The ongoing cyberattack campaign against PaperCut Application Servers has taken a more sinister turn, with researchers revealing that threat actors are now covertly installing legitimate remote access trojans (RATs) on compromised systems. What began as an urgent warning on August 27 has evolved into a full-blown security crisis, as attackers chain together two zero-day vulnerabilities to bypass authentication, execute arbitrary code, and ultimately plant remote access tools for persistent control over enterprise print management infrastructure.

For cybersecurity professionals and ethical hackers alike, this campaign represents a masterclass in modern exploitation techniques—and a stark reminder that even "benign" infrastructure like print servers can become the weak link in an organization's security posture. The attackers' ability to weaponize legitimate software like AnyDesk as post-exploitation tooling demonstrates the sophisticated, stealthy nature of today's threat landscape, where the line between legitimate administration and malicious activity is increasingly blurred.

The Anatomy of the Zero-Day Exploitation

The saga began when PaperCut Software issued an emergency security advisory on August 27, 2026, urging customers using PaperCut NG and MF print management solutions to "immediately restrict web access to trusted IP addresses only." At the time of the initial disclosure, the vendor suspected a single previously unknown vulnerability was being exploited in the wild. However, a deeper investigation revealed a far more complex attack chain involving two distinct zero-day vulnerabilities working in tandem.

These two critical flaws, when chained together, allowed unauthenticated threat actors to bypass existing authentication mechanisms, modify specific system configurations, and execute arbitrary Java bytecode under the security context of the PaperCut server process. This level of access effectively handed the attackers the keys to the kingdom, enabling them to run any commands they desired on the compromised servers without requiring valid credentials or prior access.

PaperCut Software, working alongside a university customer's security team and digital forensics and incident response (DFIR) specialists, successfully reproduced the vulnerabilities in a controlled environment. This collaboration proved crucial in understanding the attack chain and developing effective mitigation strategies. By August 28, the vendor had pushed out emergency patches to address the initial vulnerabilities, but the story didn't end there.

Rapid Response and Patch Bypasses

Later that same day, PaperCut published a second round of emergency patches, characterized as "additional hardening developed with internal security and external researchers." The vendor strongly urged customers to apply these updated patches even if they had already implemented the initial fixes—a clear signal that the threat landscape was evolving faster than initial remediation efforts could keep pace.

The security research community quickly swung into action. Rapid7 published a comprehensive technical overview of the vulnerabilities, detailing the specific attack vectors and exploitation methods. However, the most concerning development came from watchTowr researchers, who discovered multiple bypasses of the original patches and identified an additional authentication bypass vulnerability, which they responsibly reported to PaperCut. This cat-and-mouse game between security researchers and attackers highlighted the inherent complexity of securing enterprise software against determined adversaries.

Post-Compromise Activities: The Remote Access Trojan Deployment

On August 30, PaperCut provided an update on the observed post-compromise activities, offering critical insights into the attackers' playbook. The vendor noted that while every customer environment is unique—making it difficult to identify a single consistent pattern of activity—they observed specific behavioral indicators that shed light on the hacking methodology.

According to the security advisory, the attackers' first step after gaining access involves the legitimate pc-app.exe (or pc-app) process launching child shell processes (cmd.exe). These child processes then execute system enumeration commands such as "whoami" and "ver," which are standard reconnaissance commands used to gather information about the compromised system's identity and operating system version. Notably, PaperCut reported that endpoint protection solutions in some environments successfully prevented further execution and isolated the affected machines, demonstrating the value of robust endpoint detection and response (EDR) capabilities.

In cases where the attackers' initial execution was not prevented, they proceeded through a series of actions culminating in the installation of AnyDesk, a legitimate remote desktop application. This choice is particularly clever from a threat actor perspective, as AnyDesk is widely used by IT administrators for legitimate remote support purposes. By deploying a legitimate tool rather than custom malware, the attackers can often evade detection by security solutions that focus on identifying malicious files or signatures. The presence of AnyDesk on a compromised server might not raise immediate red flags, allowing the attackers to maintain persistent remote access while flying under the radar of traditional security monitoring.

Indicators of Compromise and Detection Guidance

For incident responders and security teams monitoring their environments, PaperCut has provided specific indicators of compromise (IOCs) to check for signs of post-compromise activity. The vendor recommends checking for the presence of a Windows service named 'Remote Access Service' running SimpleService.exe from the path [C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\] and examining systems for unexpected AnyDesk installations.

However, PaperCut was careful to caveat that the absence of these already-shared indicators does not necessarily mean a system has not been compromised. Attackers are constantly evolving their techniques, and the vendor acknowledged they would publish validated, specific indicators and further guidance as soon as they become available from their ongoing investigation.

Patch Availability and the Challenge of Legacy Systems

One of the most significant challenges to emerge from this incident involves patch availability across versions. The initial round of emergency patches for PaperCut NG and MF were only made available for the v25 and v26 branches, leaving older versions potentially vulnerable. The second round of patches extended coverage to the v24 branch, but a substantial portion of the installed base remains at risk.

Huntress analysts, who found evidence of exploitation in two customer environments with limited activity observed, noted a concerning statistic: "47% of the approximately 2,500 PaperCut installations Huntress tracks are running v23 or older, for which no patch is currently available." This staggering figure highlights the operational reality that many organizations run legacy software versions, either due to compatibility concerns, budget constraints, or a simple lack of awareness about the importance of timely patching.

PaperCut advises customers running PaperCut NG/MF versions older than v24 to upgrade to the latest version as soon as possible. The vendor also emphasized an often-overlooked aspect of Patch Management: "Site Servers and secondary/print servers should be updated to a patched version, not just the primary Application Server." This guidance addresses a common misconfiguration where organizations patch their primary servers but leave auxiliary components exposed. The vendor explicitly stated that other components such as Print Deploy and Mobility Print are not affected and do not need to be updated, providing clarity for IT teams navigating the patch deployment process.

Incident Response Recommendations

For organizations that suspect their PaperCut servers may have been compromised, PaperCut has provided specific incident response guidance. The vendor recommends securing current server backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious behavior was detected. This approach ensures that any persistence mechanisms or backdoors installed by the attackers are completely removed from the system.

Additionally, PaperCut advises organizations to activate their security response procedures and follow standard incident protocols. This includes preserving evidence for forensic analysis, notifying relevant stakeholders, and engaging law enforcement if necessary. The emphasis on rebuilding rather than simply cleaning the infected system reflects the reality that attackers with administrative access can install sophisticated persistence mechanisms that survive standard remediation efforts.

The Evolving Threat Landscape

The attackers' ultimate goal remains unknown, but historical context provides some clues. Three years ago, Clop and LockBit affiliates exploited two known PaperCut vulnerabilities to compromise servers and deploy ransomware, leading to data breaches and extortion demands. While this current campaign has not yet resulted in ransomware deployment, the installation of remote access tools suggests a similar endgame may be in progress—establishing access now for future exploitation.

What makes this campaign particularly noteworthy is the use of zero-day vulnerabilities rather than known bugs. This indicates a higher level of sophistication and investment on the part of the threat actors, who likely spent significant resources discovering and developing exploits for these previously unknown flaws. The additional edge provided by AI tools, which can help attackers analyze target software, surface previously unknown vulnerabilities, and write working exploits, suggests that the frequency of zero-day exploitation will only increase in the coming years.

Conclusion: Lessons for the Cybersecurity Community

The PaperCut attack campaign serves as a potent reminder that no software is too niche or "boring" to escape the attention of determined threat actors. Print management software, file transfer tools, and other enterprise utilities often fly under the radar of security teams focused on protecting more visible attack surfaces like email and cloud infrastructure. Yet these systems frequently operate with elevated privileges and access to sensitive data, making them attractive targets for attackers seeking to establish a foothold for ransomware, data exfiltration, or long-term espionage.

For security researchers and ethical hackers, this incident underscores the importance of responsible disclosure, rapid collaboration between vendors and research communities, and the critical role of threat intelligence sharing in protecting the broader ecosystem. The swift response from Rapid7, watchTowr, and Huntress—along with PaperCut's transparent communication—demonstrates how coordinated disclosure can help mitigate the impact of zero-day exploitation.

As AI-powered tools continue to democratize vulnerability research and exploit development, the window between discovery and patch deployment will only tighten. Organizations must adopt defense-in-depth strategies, segment their networks, maintain robust monitoring and incident response capabilities, and—above all—keep their software current to defend against the increasingly sophisticated threat landscape. The PaperCut compromise is not just a cautionary tale about print servers; it's a warning sign of the next generation of cybersecurity threats on the horizon.