"The concern is that those stolen logins could give attackers a pathway into other critical systems across the environment," Arctic Wolf said in a statement.
CVE-2026-81578 and CVE-2026-82078 exploited in the wild
Threat actors have been observed exploiting a recently disclosed two‑bug chain — CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) — against PaperCut servers, according to analysis by the Arctic Wolf Adversary Research Team. The chain enables initial command execution and reconnaissance and was used to create privileged accounts on compromised hosts.
Arctic Wolf Adversary Research Team's findings
Arctic Wolf reported the activity to The Hacker News and described multiple elements of post‑exploit behavior. Observed actions included delivery of Windows registry hive collection tools, Metasploit/Meterpreter‑related Java payloads, and execution of discovery commands. The company specifically listed delivery and execution patterns tied to credential theft and lateral access attempts.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTechniques, tooling and indicators observed
Arctic Wolf documented concrete indicators and binaries used by the attackers:
- Discovery commands run on compromised hosts included uname, whoami, ver, and tasklist, and the creation of a privileged account named "Administrator17".
- Inbound GET requests from 45.142.193[.]132 for files matching "/custom/pcp_*.txt" and "/custom/web/pcp_*.txt" — files that contained harvested system and user data.
- Credential‑harvesting tools delivered via certutil.exe from 45.142.193[.]132, including lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe.
- Meterpreter Java payloads were retrieved from, and sessions established to, 194.180.48[.]134.
- Use of findstr to search PaperCut *.config files for the terms "password," "secret," "ldap," "bind,v and "token".
- Arctic Wolf also detected lsa_collect.exe in a sandbox; the tool extracted specific registry keys to reconstruct the system BootKey, which can grant access to the SAM database.
Impact on schools and universities in the U.S. and Europe
Arctic Wolf said the activity has targeted vulnerable PaperCut servers across the education sector, affecting organizations from K‑12 schools to major universities in the U.S. and Europe. The observable effects included data harvesting and the potential for stolen logins to provide a path into other critical systems once credentials were collected.
Mitigations and detection steps users are advised to take
Arctic Wolf's guidance, as reported, advises restricting PaperCut servers from being exposed to the internet. Users are also advised to monitor for execution of cmd.exe, powershell.exe, or other scripting and command interpreters, and to look for commands containing whoami, tasklist, ver, or uname -a with pc-app.exe listed as the parent process. Those steps are presented as immediate operational controls to detect or limit the post‑compromise activity described.
What this means for security teams, affected schools, and adversaries
- Security teams and technologists: Watch for the named binaries (lsa_collect.exe, lsa_collect_small.exe, save_hives.exe), the inbound GET patterns to /custom/pcp_*.txt, Meterpreter Java callbacks to 194.180.48[.]134, and parent/process relationships involving pc-app.exe. Restricting public internet exposure of PaperCut servers is a prioritized preventive action.
- Affected schools and universities: Inspect systems for newly created privileged accounts such as "Administrator17", review .config files for unauthorized changes, and search logs for requests to 45.142.193[.]132 and retrievals from 194.180.48[.]134. Treat any discovery command executions (uname, whoami, ver, tasklist) from pc-app.exe as high priority.
- Adversaries and defenders alike: The documented use of registry hive extraction tools to reconstruct a BootKey — and the subsequent access to the SAM database — underscores why credential harvesting from PaperCut compromises can enable broader movement across environments rather than remaining an isolated incident.
Arctic Wolf's reporting ties a concrete exploitation chain to observable tooling, IP callbacks and file‑system behaviors. The combination of an authentication bypass plus remote code execution, the delivery of registry hive harvesters, and the creation of privileged accounts frames this as an operationally significant campaign against educational institutions that administrators should treat accordingly.
