Threats tagged 'papercut mf'

On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF version 24.0.2, targeting an internet-facing print server in the Education sector. The attackers deployed an in-memory Java loader to establish a web shell, through which they delivered a trojanized Microsoft Copilot binary containing an AdaptixC2 implant. This implant connected to command-and-control infrastructure hosted on Alibaba servers. After a dormant period, the attackers performed reconnaissance and Active Directory enumeration, stole a token from a domain-privileged service account, and moved laterally to a domain controller. On the domain controller, they dumped credentials, enabled Windows Restricted Admin mode for pass-the-hash attacks, and extracted the NTDS.dit database, achieving full domain compromise.