Hackers Chain PaperCut Print Software Flaws to Steal Credentials From Schools and Universities

Attackers are chaining two newly disclosed vulnerabilities in PaperCut's print management software to break into schools and universities in the United States and Europe, using the foothold to harvest Windows credentials and pivot deeper into victim networks. According to The Hacker News, the activity has been observed by Arctic Wolf's Adversary Research Team, which has been tracking exploitation since the flaws became known.

The two vulnerabilities, tracked as CVE-2026-81578 and CVE-2026-82078, can be chained together to bypass authentication and execute code remotely on a PaperCut server, Arctic Wolf told The Hacker News. Once that initial foothold is established, the attackers move to recon and credential theft rather than ransomware or extortion — a pattern that suggests the goal is long-term access to education networks rather than immediate disruption.

Education institutions are attractive targets for this class of attack because PaperCut's print management software runs across large fleets of devices and is often maintained by overstretched IT teams, where patching cycles lag behind disclosure. cisoai.au, summarising the Arctic Wolf findings, made the same point: print management systems sit quietly on university and K-12 networks for years, which makes them useful staging points once a serious bug emerges.

What the Attackers Did Once Inside

Arctic Wolf's post-exploitation observations, as reported by The Hacker News, describe a methodical credential-harvesting operation rather than a smash-and-grab. Attackers ran discovery commands — uname, whoami, ver, tasklist — and created a privileged local account named Administrator17, giving themselves a persistent backdoor even if the original exploit path is closed.

From a server with the IP address 45.142.193[.]132, the attackers pulled Windows registry-hive collection tools (lsa_collect.exe, lsa_collect_small.exe, save_hives.exe) onto compromised hosts using certutil.exe, a built-in Windows utility often abused because it is rarely blocked by security tools. They also retrieved Meterpreter Java payloads — the in-memory post-exploitation agent shipped with the Metasploit framework — from 194.180.48[.]134, allowing interactive control without dropping a traditional executable.

Targeting PaperCut's Own Configuration Files

A telling detail in the Arctic Wolf findings is that the attackers specifically searched PaperCut's own configuration files for the strings "password", "secret", "ldap", "bind", and "token" using the Windows findstr utility. PaperCut servers often hold credentials for LDAP directories, which universities use for centralised sign-on, and for the application's own authentication token. Anyone with read access to those files can extract plaintext or weakly protected secrets, then reuse them against mail servers, file shares and single sign-on systems elsewhere on the same campus.

In a sandbox, Arctic Wolf also observed lsa_collect.exe extracting the specific registry keys needed to reconstruct a Windows system's BootKey, the cryptographic seed used to encrypt the SAM database where local account password hashes live. With the BootKey and the SAM, an attacker can crack those hashes offline at their leisure — meaning a single compromised print server can yield credentials for every account that has ever logged into it.

“The concern is that those stolen logins could give attackers a pathway into other critical systems across the environment. Post-compromise activity included deployment of Windows registry [harvesting tools].”

— Arctic Wolf, as reported by The Hacker News

What Defenders Should Look For

Arctic Wolf's recommended detection guidance, reported by The Hacker News, focuses on a few high-signal behaviours that defenders can hunt for. PaperCut's service binary, pc-app.exe, should not normally spawn cmd.exe or powershell.exe; if it does, that is a strong indicator of exploitation. Unusual inbound requests to /custom/pcp_*.txt and /custom/web/pcp_*.txt paths, and the appearance of lsa_collect-family tools on the filesystem, are similarly out-of-pattern. Beyond hunting, Arctic Wolf advises organisations to ensure PaperCut servers are not directly exposed to the internet and to apply vendor patches as soon as updated builds are available.

What Is Still Unverified

Several details in the public reporting could not be independently corroborated against a primary source within the material provided. The Hacker News does not link to a PaperCut security advisory or an Arctic Wolf blog post; cisoai.au is an unrecognised secondary outlet. The CVE identifiers, the specific victim institutions, the IP addresses used as indicators of compromise, and the timeline of disclosures have not been verified against vendor or researcher publications here, and readers should treat them as claims from Arctic Wolf relayed by The Hacker News rather than as established fact. No Pakistan-specific targeting or impact is mentioned in either source.