# 2026-09-04: Exploited PaperCut Vulnerabilities (CVE-2026-81578 & CVE-2026-82078) Lead to Credential Theft

## ANALYSTS
- Jens Pose and Ross Phillips

## KEY FINDINGS
- Arctic Wolf observed exploitation of PaperCut servers affected by CVE-2026-81578 and CVE-2026-82078 leading to command execution, reconnaissance, and attempts to create privileged accounts.
- Observed post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitive configuration data.

## BACKGROUND
PaperCut is enterprise print-management software that has previously been exploited (i.e., CVE-2023-27350 and CVE-2023-27351) to deliver LockBit ransomware.

PaperCut disclosed active exploitation of vulnerabilities on August 27, 2026; CVEs were assigned the following day, and both were added to the CISA Known Exploited Vulnerabilities catalog on August 31, 2026.

## TECHNICAL DETAILS
- Exploitation activity included standard discovery commands (`uname`, `whoami`, `ver`, and `tasklist`) and privileged account creation (`Administrator17`).
- Inbound GET requests from `45[.]142[.]193[.]132` requested `/custom/pcp_*.txt` and `/custom/web/pcp_*.txt` files on compromised hosts, containing harvested system and user data.
- Credential-harvesting tools (`lsa_collect.exe`, `lsa_collect_small.exe`, and `save_hives.exe`) were pulled via `certutil` from `45[.]142[.]193[.]132`.
- Meterpreter Java payloads were retrieved from, and established sessions to, `194[.]180[.]48[.]134`.
- Attackers used `findstr` to search PaperCut `*.config` files for the terms “password,” “secret,” “ldap,” “bind,” and “token.”
- `lsa_collect.exe` was observed in a sandbox extracting specific registry keys to reconstruct the system `BootKey`, which would give the attacker access to the SAM database.

## DEFENSIVE CONSIDERATIONS
- Search PaperCut `server.log` files for the vendor-published exploitation-related strings:

  ```
  jdbc:derby:memory:pwn;create=true
  ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
  ERROR No suitable driver found for jdbc:no:x
  VALUES CAST(X'cafebabe
  ```

- Search PaperCut directories for short five-character `.class`, `.cmd`, and `.out` files.
- Monitor for `pc-app.exe` spawning `cmd.exe`, `powershell.exe`, or other scripting and command interpreters. Review the complete command line and network activity for each event.
- Hunt for commands containing `whoami`, `tasklist`, `ver`, or `uname -a` with `pc-app.exe` as the parent process.
- Search endpoint telemetry for `lsa_collect.exe`, `lsa_collect_small.exe`, `save_hives.exe`, or the relevant hashes below.
- Review account-management events for creation or attempted creation of `Administrator17` and other unexpected privileged accounts, especially shortly after suspicious PaperCut activity.
- Search web and file-access logs for requests to `/custom/pcp_*.txt` or `/custom/web/pcp_*.txt` and large file retrievals with User-Agent `python-requests/*`.
- Restrict PaperCut management interfaces from direct internet exposure and apply the vendor-recommended fixes.

## INDICATORS OF COMPROMISE
The indicators below represent a subset of the IOCs associated with this activity and should not be considered exhaustive.

```
# FILE HASHES
c3f7109963b9599eb93fd9a97a4ffa38e672642b35b33608d69e6bbf9f19da4e - lsa_collect.exe
14779d0d7ad6be3d7bf9ed78e4ab6016f22dfa7bc8b5d9c43b56011f7fe2ea19 - save_hives.exe

# IP ADDRESSES
45[.]142[.]193[.]132
45[.]142[.]193[.]196
194[.]180[.]48[.]134

# URLS
http[:]//45[.]142[.]193[.]132:8000/lsa_collect.exe
http[:]//45[.]142[.]193[.]132:8000/lsa_collect_small.exe
http[:]//45[.]142[.]193[.]132:8000/save_hives.exe
http[:]//194[.]180[.]48[.]134/kjmdcyzq/com/metasploit/meterpreter/JarFileClassLoader.class

# USER AGENTS
python-requests/2.32.5

# USERNAMES
Administrator17

# ARTIFACTS AND COMMANDS
## FILE NAMES
lsa_collect.exe - credential-collection tool
lsa_collect_small.exe - credential-collection tool
save_hives.exe - hive-collection tool

## PROCESS COMMANDS
cmd.exe /d /s /c "ver || uname -a"
cmd /c "whoami & ver & tasklist"
findstr /s /i /n /c:"password" /c:"secret" /c:"bind" /c:"ldap" /c:"token"

## FILE PATTERNS
/custom/web/pcp_[0-9a-z]{10}.txt || /custom/pcp_[0-9a-z]{10}.txt - observed across multiple victims after successful exploitation; used for command-output retrieval or collected data.
```