🤖 Inside a PaperCut attacker’s AI toolkit: custom Rust credential collectors and chisel persistence

Hunt.io researchers pulled the tooling from three open directories on the PaperCut campaign infrastructure. Some of the samples and scripts worth looking at:

Four custom Rust Windows binaries: lsa_collect.exe (core LSA secret collector), lsa_read.exe (direct LSA reader), save_hives.exe (offline registry hive exporter using SeBackupPrivilege), and collect_custom.exe (combined LSA collection plus host/domain fingerprinting including ComputerName, TCP/IP config, and ControlSet info).

The companion decrypt_machine_hash.py parses the structured output from the collectors, reconstructs the Windows boot key, derives the LSA key from encrypted PolEKList data, and recovers the machine account NT hash offline.

A separate parse_service_credentials.py scans PaperCut config files and logs for database credentials, LDAP bind passwords, keystore passwords, and service account secrets using patterns based on PaperCut config keys.

Linux persistence: chisel binary + stage.sh + watch.sh deployed to /var/tmp/.rs_live46_v5/. Stage.sh downloads components from 45.142.193[.]132:18081 and sets cron for persistence. Watch.sh monitors and restarts the chisel reverse SOCKS5 tunnel on port 18443.

Hashes in the blog post. Full analysis: https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce