{"id":2700,"date":"2026-09-05T07:37:11","date_gmt":"2026-09-05T07:37:11","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2700"},"modified":"2026-09-05T07:37:11","modified_gmt":"2026-09-05T07:37:11","slug":"attackers-exploit-papercut-flaws-to-steal-credentials-from-schools-and-universities","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2700","title":{"rendered":"Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 05, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe.<\/p>\n

The Arctic Wolf Adversary Research Team said<\/a> it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 \u2013 an authentication bypass and remote code execution chain \u2013 to conduct command execution and reconnaissance, as well as create privileged accounts.<\/p>\n

\u00abObserved post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit\/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitive configuration data,\u00bb Arctic Wolf said.<\/p>\n

The cybersecurity company told The Hacker News that the activity has targeted vulnerable PaperCut servers across the education sector, impacting organizations ranging from K-12 schools to major universities in the U.S. and Europe.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Some of the identified malicious activity includes –<\/p>\n

    \n
  • Running discovery commands like uname, whoami, ver, and tasklist, and privileged account creation (\u00abAdministrator17\u00bb)<\/li>\n
  • Inbound GET requests from \u00ab45.142.193[.]132\u00bb that request for \u00ab\/custom\/pcp_*.txt\u00bb and \u00ab\/custom\/web\/pcp_*.txt\u00bb files on compromised hosts, containing harvested system and user data<\/li>\n
  • Deliver credential-harvesting tools like lsa_collect.exe, lsa_collect_small.exe, and save_hives.exe via \u00abcertutil.exe\u00bb from \u00ab45.142.193[.]132\u00bb <\/li>\n
  • Retrieve Meterpreter Java payloads from, and establish sessions to, \u00ab194.180.48[.]134\u00bb<\/li>\n
  • Use \u00abfindstr\u00bb to search PaperCut *.config files for the terms \u00abpassword,\u00bb \u00absecret,\u00bb \u00abldap,\u00bb \u00abbind,v and \u00abtoken\u00bb<\/li>\n<\/ul>\n

    Arctic Wolf said it also detected \u00ablsa_collect.exe\u00bb in a sandbox that extracted specific registry keys to reconstruct the system BootKey, which can then grant the attacker access to the SAM database.<\/p>\n

    \u00abThe concern is that those stolen logins could give attackers a pathway into other critical systems across the environment. Post-compromise activity included deployment of Windows registry,\u00bb Arctic Wolf said in a statement.<\/p>\n

    Users are advised to restrict PaperCut servers from being exposed to the internet and monitor for the execution of cmd.exe, powershell.exe, or other scripting and command interpreters, along with commands containing whoami, tasklist, ver, or uname -a with pc-app.exe as the parent process.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \ue804Ravie Lakshmanan\ue802Sep 05, 2026Vulnerability \/ Web Security Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and…<\/p>\n","protected":false},"author":1,"featured_media":2701,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,446,120,11,3209,3313,571,2017],"class_list":["post-2700","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attackers","tag-credentials","tag-exploit","tag-flaws","tag-papercut","tag-schools","tag-steal","tag-universities"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2700","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2700"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2700\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2701"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2700"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2700"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}