Observed incident

AI-orchestrated PaperCut campaign compromises hundreds of servers

Reported

What happened

GreyNoise linked an AI-orchestrated exploitation campaign to at least 440 PaperCut instances at 395 identified organizations, including credential harvesting and some domain-administrator compromises.

Parties and reporting

AI tools and systems: OpenAI Codex harness with a DeepSeek model, PaperCut NG/MF, Metasploit, Chisel

Outcome

Researchers coordinated victim notifications. Hunt.io's October follow-up found persistent access and credential-collection artifacts; neither report establishes complete cleanup or subsequent ransomware outcomes.

Operating lesson

After patching an exposed server, investigate persistence, rotate connected credentials and verify that access to the internal network is closed.

Evidence and limits

August exploitation preceded the September 9 AI-campaign disclosure; October 15 is follow-up coverage. Codex supplied the harness, not an OpenAI model. Researcher counts and attacker inventories are distinct; Russian-language clues do not prove state sponsorship.

Sources