# When the Attacker Has an Army That Never Sleeps: AI Agents Hit 440 PaperCut Servers
Print management software sits at the intersection of every network: it knows who's printing what, routes jobs across infrastructure, and almost always runs with elevated privileges nobody's revisiting at the quarterly access review. That's why PaperCut has been a target of choice for ransomware operators since at least 2023. But the latest campaign against it represents something different in kind, not just scale — a threat actor deploying hundreds of AI agents to identify, enumerate, and compromise over 440 PaperCut instances with a level of parallelism no human crew could replicate.
This is the first well-documented case of an attacker using agentic AI as the primary operational layer of a large-scale exploitation campaign. It won't be the last.
## What PaperCut Is and Why Attackers Keep Coming Back
For readers who've managed to avoid PaperCut in their threat models: it's print and device management software used by universities, hospitals, law firms, and government agencies — anywhere people still print, which is basically everywhere. PaperCut MF and NG run on Windows or Linux servers, typically with high-privilege service accounts, and they're frequently internet-facing because administrators need remote visibility into print queues.
In April 2023, CVE-2023-27350 dropped — an authentication bypass with a CVSS score of 9.8 that Cl0p and LockBit were exploiting within days of public disclosure. The Cybersecurity and Infrastructure Security Agency issued an emergency directive. Patches were available. Exposure remained high for months because PaperCut servers sit in IT closets, not on the patch management fast track.
That campaign was opportunistic and fast. This one is something else.
## Hundreds of Agents, 440 Compromises
The attacker didn't send a handful of exploit scripts. They stood up what researchers describe as a coordinated fleet of AI agents — hundreds of them — operating in parallel to identify PaperCut instances, test authentication states, adapt to environmental differences between targets, and execute post-exploitation steps.
The 440+ compromised instances aren't the result of a single working exploit running across a list of IPs. They're the result of what appears to be autonomous decision-making at each target: agents that could distinguish a patched instance from an unpatched one, identify whether the application server configuration allowed certain attack paths, and pivot accordingly.
That adaptability is the story. Traditional botnet-driven exploitation is fast but brittle — the same payload, fired at everything, succeeds where conditions match and fails everywhere else. AI agents that reason about each target's specific state change the economics of exploitation entirely. You don't need a vulnerability that works everywhere. You need a vulnerability that works *somewhere* across a large enough target set, and you need agents flexible enough to find exactly where.
## The Operational Model
What the researchers documented is essentially a red team operation run without human operators in the loop. The AI agents appear to have handled:
Running this in parallel across hundreds of agents means the attacker wasn't rate-limited by human attention. A skilled operator working through 440 targets manually would take weeks. An AI agent fleet does it in hours, with consistent tradecraft across every target.
The implication for defenders is uncomfortable: detection logic built around human-speed attack patterns — a burst of failed authentication attempts, a spike in unusual API calls — may not catch this. Agent-based attacks can be designed to move slowly and carefully on any individual target even while the fleet as a whole operates at extraordinary speed.
## Why Print Management Systems Are the Wrong Place to Be Exposed
PaperCut lives on its own in a lot of environments: provisioned once, rarely touched, running a service account that was set up when the server was stood up four years ago. Security teams focused on cloud infrastructure, endpoint detection, and identity management have legitimate reasons to deprioritize a print server. Attackers know this.
The specific risks that make PaperCut a valuable target:
Any of these would make a print management server worth attacking. All of them together explain why this campaign hit 440 instances instead of ten.
## What Defenders Should Do Right Now
If you're running PaperCut MF or NG:
---
## HackWire Analysis
The PaperCut campaign is a threshold moment, and the coverage has mostly missed what makes it structurally different from prior exploitation waves.
Every major PaperCut incident before this one — including the Cl0p and LockBit campaigns in 2023 — followed a familiar playbook: vulnerability disclosed, ransomware affiliates run mass scanners, race to exploit before patches deploy. The attacker was bounded by human operator time and the need for individual hands-on-keyboard activity at some phase of the kill chain.
What's documented here is the removal of that bottleneck. When you can deploy hundreds of AI agents that reason about target state, adapt their approach, and execute post-exploitation steps without human intervention, you've effectively industrialized targeted attacks. The unit economics flip: it's no longer expensive to go after 440 targets with nuanced, environment-aware tradecraft. It's cheap.
This matters enormously for how we think about "opportunistic" versus "targeted" attacks. Those categories have always been a spectrum, but AI agents can now make targeted behavior look opportunistic at scale. An attack that compromises 440 instances with tailored exploitation isn't opportunistic in the traditional sense — it's systematic and adaptive. But it's also not the work of a team of operators. It's a fleet.
The implications for detection are serious. Behavioral baselines built around human attack speed need to be reconsidered. Rate-limiting and velocity-based detection help against scanners; they're less effective against a fleet that deliberately paces each agent to appear like normal traffic. Defenders need to be looking at behavioral *patterns* across individual sessions — the specific sequence of reconnaissance, authentication testing, and API calls — not just volume.
One more thing nobody is saying clearly: this technique isn't going back in the bottle. Whatever attacker ran this campaign has shown the model works at scale. Within 12 months, expect this approach in criminal toolkits available to ransomware affiliates, not just sophisticated threat actors.
PaperCut is a real and present exposure that needs immediate attention. The AI agent piece is the warning about what the next two years look like.
— HackWire Editorial
---
## Related Coverage