🤖 Inside a PaperCut attacker’s AI toolkit: 1,005 hosts in recon pool, 46 AD domains, 45 live pivots at time of capture

We pulled three open directories from the PaperCut campaign's orchestration host (45.142.193[.]132) while the operator was still using them. The research extends the initial reporting from GreyNoise and Blackpoint Cyber with the full post-exploitation pipeline and campaign-scale data from the attacker's own files.

Scale from the operator's notes: reconnaissance pool of 1,005 hosts across 45+ countries (800 confirmed vulnerable, 205 version-based candidates), 46 distinct Active Directory domains across the packaged victim kits, and 45 targets with confirmed live reverse SOCKS5 pivots at capture time.

The country distribution closely matches GreyNoise's published breakdown, with the US and UK accounting for the largest share. One comes from defender telemetry, the other from the actor's own notes, but both point to the same operation.

We also found a second RCE path through XML-RPC that doesn't depend on the Tapestry vulnerability chain, plus AI agent instructions showing how the campaign used DeepSeek through OpenAI Codex with up to 25 concurrent subagents.

Sector breakdown from AD domain naming: education (39%), public libraries (4%), nonprofits (4%), with 52% unidentifiable from naming alone.

https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce