{"id":243905,"date":"2026-09-11T01:23:59","date_gmt":"2026-09-11T06:23:59","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/09\/papercut-attacker-uses-hundreds-of-ai-agents-to-compromise-440-instances"},"modified":"2026-09-11T01:23:59","modified_gmt":"2026-09-11T06:23:59","slug":"papercut-attacker-uses-hundreds-of-ai-agents-to-compromise-440-instances","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/09\/papercut-attacker-uses-hundreds-of-ai-agents-to-compromise-440-instances","title":{"rendered":"PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/papercut-attacker-uses-hundreds-of-ai-agents-to-compromise-440-instances.jpg\"><\/a><\/p>\n<p>A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of <a href=\"https:\/\/thehackernews.com\/2026\/09\/attackers-exploit-papercut-flaws-to.html\" target=\"_blank\">security flaws in PaperCut NG\/MF<\/a> and break into hundreds of instances.<\/p>\n<p>According to independent reports from <a href=\"https:\/\/blackpointcyber.com\/blog\/death-by-a-thousand-papercuts-ai-driven-exploitation-at-scale\/\" target=\"_blank\">Blackpoint Cyber<\/a> and <a href=\"https:\/\/www.greynoise.io\/blog\/ai-orchestrated-campaign-against-papercut-ng-mf\" target=\"_blank\">GreyNoise<\/a>, the activity originates from \u201c<a href=\"https:\/\/www.virustotal.com\/gui\/ip-address\/45.142.193.132\/\" target=\"_blank\">45.142.193[.]132<\/a>,\u201d an IP address that has been linked to unauthorized port scanning and brute-force attack attempts in recent weeks. It\u2019s worth noting the same IP address was also <a href=\"https:\/\/thehackernews.com\/2026\/09\/attackers-exploit-papercut-flaws-to.html\" target=\"_blank\">flagged<\/a> by Arctic Wolf in connection with the exploitation activity last week.<\/p>\n<p>\u201cAt this time, we cannot confirm the exact end goal of this campaign,\u201d Nevan Beal, principal MDR analyst at Blackpoint, told The Hacker News. \u201cThe threat actor\u2019s methodology is consistent with initial-access activity, but we do not yet have sufficient evidence to confirm whether they are operating as an initial access broker.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence (AI) to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG\/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and GreyNoise, the activity originates from \u201c45.142.193[.]132,\u201d an IP address that has been [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,6],"tags":[],"class_list":["post-243905","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-robotics-ai"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/243905","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=243905"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/243905\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=243905"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=243905"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=243905"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}