# IOC dossier — CVE-2026-82078 (+ CVE-2026-81578 chain) — ARL Case 003
**Date:** 2026-09-11 · **Author:** phase-06 detection engineer · **Provenance:** OUR OWN authorized lab reproduction (PaperCut NG 25.0.11.75758 container, isolated docker net cve82078_lab/172.30.77.0/24).

> **READ FIRST — what is lab artifact vs attacker-generic.**
> ARL Case 003 reproduced the publicly-documented chain (vendor advisory +
> Rapid7 module + Huntress reporting) in our lab with OUR PoC. Everything
> below is tagged:
>   **[LAB]** = artifact of OUR specific tooling/reproduction. It identifies
>   OUR runs, NOT real attackers. Never ship as a threat-intel pivot.
>   **[GENERIC]** = shape produced by the vulnerability/attack technique
>   itself (also carried by msf-family and plausible hand-crafted variants).
>   **[VENDOR]** = published by PaperCut / the CVE record.

## 1. Filesystem remnants on the target (server home = /usr/local/papercut/server)

| IOC | Tag | Notes |
|---|---|---|
| `server/lib/<A-Za-z8>.class` appearing with fresh mtime, then VANISHING within seconds | [GENERIC] | Derby SYSCS export drops it; the class deletes itself at payload teardown (phase04 a6-fswatch: appeared+gone; vendor IOC analogues `<5-char>.class`). Window to catch: seconds — use fs-watch/EDR, not scheduled scans. |
| `server/tmp/<8lower>.csv` same appear/vanish pattern | [GENERIC] | the SYSCS export CSV companion (`tmp%2F<rand>.csv` in the wire body). |
| `/tmp/<marker-file>` created by the loaded class | [LAB] OUR proof-of-execution marker: `/tmp/cve2026-82078-canary` (internal capture name in case.yaml + raw evidence) — content `cve2026-82078` (14 B, sha256 `aeba89c392bd3c5e6f753d474b72eeaca5b6c59e0b3ad2e19d4f914f0ea55580`, owner papercut:644) | A real attacker's marker differs (msf-family: `/tmp/<rand>` or vendor-IOC `data/content/<5-char>.cmd/.out` litter). Hunt the SHAPE (JVM-created world-readable file under /tmp by the service account), not our name. |
| `data/internal/derby.log` growth outside maintenance: `Booting Derby version ... on database directory memory:/usr/local/papercut/server/data/internal/<8lower>` | [GENERIC] | the memory-DB create echo; stock internal DB is file-dir, never `memory:`. |
| (v24/25 vendor-IOC chain litter, third-party: `data/content/*.cmd/.out`, base64 `whoami & ver`) | [VENDOR]/[GENERIC] | from the vendor advisory IOC section; NOT produced by our PoC — listed so responders hunt the union. |

## 2. Process signatures (measured kill-shot shape)

```
papercut  <ppid>  ../runtime/linux-x64/jre/bin/pc-app ... \
    org.tanukisoftware.wrapper.WrapperSimpleApp biz.papercut.pcng.server.AppServer   (comm: pc-app)
  └─ papercut  /bin/sh -i                                   <- payload (Socket -> ProcessBuilder)
       └─ papercut  ps -ef                                  <- our evidence cmd [LAB]; real attackers run recon/parsers
```
* [GENERIC] parent=PaperCut app JVM (comm `pc-app`, cmdline carries `org.tanukisoftware.wrapper` + `biz.papercut.pcng.server.AppServer`) with child `/bin/sh -i` — Sigma rule `cve2026_82078_pcapp_sh_child.yml` (measured run-04c: pid 11666 ppid 8696; fresh phase-06 run: pid 2096 ppid 1127 after a container restart — pids drift, shape constant).
* [LAB] the specific grandchild `ps -ef` + connect-back to 172.30.77.1:4444.
* Windows-family analogue per vendor IOC (`cmd.exe /c whoami & ver` chains) [VENDOR].

## 3. Wire shapes (attempt-level unless marked; identical bytes on patched arms = inert there)

| Pattern | Tag | Where |
|---|---|---|
| POST `/app?service=direct/<8lower>/Home/ConfigEditor/quickFindForm` body `...%24TextField=user-lookup.db-driver&doQuickFind=Go` (raw-$ or %24 form) | [GENERIC] attempt | Suricata 202682041, YARA wire rule |
| POST `.../Home/ConfigEditor/$Form` body setting `%24TextField%240=org.apache.derby.jdbc.EmbeddedDriver` / `jdbc%3Aderby%3Amemory%3A<rand>%3Bcreate%3Dtrue` / `CALL+SYSCS_UTIL.SYSCS_EXPORT_QUERY_LOBS_TO_EXTFILE%28...%27tmp%2F<rand>.csv%27...%27lib%2F<8mix>.class%27%29` | [GENERIC] stage | Suricata 202682042/43 |
| POST `.../Home/UserList/$QuickFind.$Form` body `%24TextField=VALUES+CAST%28X%27CAFEBABE...%27+AS+BLOB%29` | [GENERIC] stage (CAFEBABE=classfile magic — msf-family + our PoC; hand-crafted may omit) | Suricata 202682044 |
| HTTP 302 + `Location: /app?service=page/Home` answering the above | [VENDOR-mechanism] | the FIX (ValidatingDirectService); its presence = blocked attempt, not compromise |
| HTTP 200 + `<!-- Page: Home -->` answering a forged direct POST from an un-authed session | [GENERIC] bypass-accepted | Suricata 202682047 |
| SYN from PaperCut server host -> high port 4440-4450/8088 (connect-back) | [GENERIC] execution (reverse-shell variants only) | Suricata 202682045 |
| Our exact class bytes / exact listener 172.30.77.1:4444 / exact random names (`IyoOdUmb.class`, `nojujyev.csv`...) | [LAB] | run-specific; do not pivot |

## 4. Log line shapes (server.log / derby.log)

| Pattern (EXACT bytes) | Tag |
|---|---|
| `ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST(X'CAFEBABE...') AS BLOB).  Error: ... DB URL: jdbc:derby:memory:<rand>;create=true DB Driver: org.apache.derby.jdbc.EmbeddedDriver DB Username:  - ... [http-NN]` | [GENERIC] success-path trace (measured 3 arms' worth of windows) |
| `Booting Derby version The Apache Software Foundation - Apache Derby - <ver>: instance <uuid>` + `on database directory memory:/usr/local/papercut/server/data/internal/<rand>` | [GENERIC] |
| marker string `cve2026-82078` (appears inside our hex-BLOB class constant pool, e.g. `637665323032362D3832303738`) | [LAB] |

## 5. PoC marker names (from case.yaml — single source; the strings are internal capture names preserved verbatim in raw evidence)

* [LAB] dry-run marker: `/tmp/cve2026-82078-canary`
* [LAB] defacement marker: `/tmp/cve2026-82078-defaced` (never created in any run)
* [LAB] payload marker string: `cve2026-82078`

## 6. Asset hashes (custody records — installers of the THREE lab arms)

| Arm | Build | sha256 | Provenance |
|---|---|---|---|
| stock (vulnerable) | 25.0.11.75758 | `644957717fcb93313e96f8be0e18566a5d49ed0583d0814a7310fe958b5ef17a` | [LAB custody] vendor publishes no checksum for this older build; our intake hash is the custody record (STATUS gate ledger) |
| patched MR | 25.0.13.76605 | `f21311fa3833a80d8d16bdc9516004fc9c3f834b0077e4a1f8fd550d10d7b8e1` | [VENDOR] MATCH vs bulletin row PaperCut NG/Linux/Build 76605 (facts.json) |
| EPR3 (intermediate) | 25.0.12-PO-4560.76533 | `68858979b4db69e7c4dc41f2d50ea2642a087855601bdb7f33d8a294c259fbdb` | [VENDOR] MATCH vs Wayback bulletin row Linux/Build 76533 |

These identify OUR lab arms (and, for the latter two, any copy of the official
installer). They are NOT attacker IOCs — they exist so any analyst can verify
which binary a screenshot/log came from.

## 7. Dropped-class artifact hashes [LAB]

Class bytes differ EVERY run (8-char class name + csv path + connect-back
params are randomized per invocation), so no single class hash is a hunt
pivot; anchor on the shape instead (CAFEBABE header, major 52, ~977 B,
constant-pool contains `/tmp/` + `resolve` + a `.class` path string — see
exploit classfile builder). Recorded run hashes for audit trail:
* run-01 dry: class sha256 `7b824e91ecfc073c…` (truncated in phase04 log), 977 B
* phase06 race2 dry: `8083583cb8e64c446352a34fdce4fefb8dc65cd0dac2d90425c5a34b2a4fd89b`, 977 B, bcn `CgKInMEx`
* marker FILE content hash is CONSTANT across runs: `aeba89c392bd3c5e…` (content = marker string)

## 8. Detection package cross-ref

Every pattern above maps to a live-fired rule; the fire-transcript index is
`detection/sigma-fires.md`. Rules absent from that table were cut, not
shipped.