Estimated read time: 7 minutes
Security researchers at GreyNoise published a campaign breakdown this week that should change how you think about software updates, and not for the reason most of the coverage suggests. A threat actor wired up hundreds of AI agents, pointed them at two known vulnerabilities in PaperCut NG/MF print management software, and compromised at least 440 servers belonging to 395 organizations across 48 countries.
Most outlets ran the headline number. The number that actually matters is buried in the timeline. The attacker went from an empty workspace to remote code execution on a real victim in under four hours. Two hours after that, they had domain administrator access somewhere. Once the campaign properly launched, eleven organizations fell in twenty six seconds.
If you run a small business, you have almost certainly been operating on an unspoken assumption: that there is a gap between a vulnerability becoming public and someone bothering to come after a company your size. That gap was real. It was measured in weeks, sometimes months, because building a working exploit and then finding enough targets to make it worth the effort took human labor. That labor just got automated.
Table of Contents
What actually happened
PaperCut NG/MF is print management software. It sits on a server and handles who can print what, tracks usage, bills departments, and releases jobs at the machine. Schools run it. Law firms run it. Clinics run it. It is the definition of software that gets installed once, works, and is never thought about again.
The attacker, described by GreyNoise as likely Russian speaking, assembled a toolkit out of parts anyone can buy or download: OpenAI’s Codex harness for orchestration, a DeepSeek model, and off the shelf offensive security tooling. Then they ran hundreds of agent instances in parallel to develop exploits for two PaperCut flaws and hunt for exposed servers.
The results, per GreyNoise: credentials harvested from 280 victims, operating system or domain secrets pulled from 147, and full administrator privileges at 12 organizations. Roughly half the victims were in education.
Worth noting, because it says something about where this technology actually is: some of the agents went off script. They wandered, repeated themselves, and did things the operator did not intend. This was not a clean machine. It was a swarm of mediocre workers who never got tired, and that turned out to be more than enough.
The number that matters is four hours
Here is the old math. A vendor discloses a flaw and ships a patch. Somewhere in the world, a person with the skill to write a working exploit decides whether your category of target is worth their week. Then they have to find enough vulnerable servers to justify the effort. Every one of those steps cost time, and that time was your buffer. You could patch on a Tuesday two weeks later and be fine, because statistically nobody had gotten around to you yet.
The new math removes the human bottleneck from all three steps. Exploit development, target discovery, and execution can run in parallel, around the clock, for the price of API tokens. Four hours from nothing to a live compromise. Eleven organizations in under half a minute once the thing was pointed at a target list.
What that means practically: patch timing is no longer a scheduling question, it is a risk question. The reasonable small business posture used to be to batch updates monthly. That posture assumed a buffer that no longer exists for anything internet facing.
This is the same structural shift we wrote about in the AI email summarizer hijack, just pointed at infrastructure instead of inboxes. The attack itself is not novel. The economics are.
Half the victims were schools, and that is the tell
Education accounted for roughly half of the breaches. That is not because schools are especially careless. It is because schools look, from an attacker’s perspective, exactly like a small business: one or two people handling all of IT, a stack of software that accumulated over a decade, a print server nobody has logged into since the person who installed it left, and no budget line for a security audit.
If that describes your operation, the lesson is not that you need an enterprise security program. It is that the thing most likely to get you is not your website or your customer database. It is the boring appliance in the back room. Print servers, network attached storage, old office routers, a security camera recorder, a scanner that has a web interface, a VPN box from 2019. All of it is software. All of it gets vulnerabilities. Almost none of it is on anyone’s update list.
Attackers do not target you as a company. They target a vulnerability and take whoever is holding it. Being small stopped being camouflage the moment finding you became free.
440 got in. Twelve got the keys.
There is good news in this data and almost nobody reported it. At least 440 instances were compromised. Credentials came out of 280. Domain or system secrets came out of 147. But full administrator access was achieved at only 12 organizations.
Read that as a ratio. Roughly 97 percent of the organizations that got breached did not lose the whole network. Something stopped the attacker between owning a print server and owning everything: network segmentation, accounts that were not reused, a print server that was not running as a domain administrator, monitoring that caught the lateral movement.
That is the actionable insight. You are probably not going to win the race to patch every box within four hours of a disclosure. No small business is. What you can do is make sure that when something does get in, it lands in a room with no doors. Containment is cheaper than prevention, and it is the thing that actually separated a bad week from a business ending one here.
What to actually do this week
None of this requires a consultant or a budget. It requires about three hours and a willingness to look at things you have been ignoring.
1. Write down everything with an IP address
Not your SaaS tools. The physical and virtual boxes: servers, network storage, printers with web panels, cameras, routers, firewalls, anything with a login screen on your network. Most small businesses cannot produce this list, which is the actual problem. You cannot patch an inventory you do not have.
2. Ask one question about each item: is it reachable from the internet?
A print server that only answers to devices inside your office is a very different risk from one that answers to anyone. The PaperCut campaign found its victims by scanning for exposed instances. If a box does not need to be public, put it behind the firewall or a VPN and the mass scanning problem largely disappears for that box.
3. Turn on automatic updates for anything internet facing
The classic objection is that an auto update might break something. That was a defensible trade when your buffer was three weeks. At four hours it is not. Auto update the exposed things, and keep manual control over the internal ones where an outage would actually stop work.
4. Stop letting service accounts be administrators
This is the single change that separates the 12 from the 428. Print software does not need domain admin. Your backup tool does not need domain admin. Whoever set these up almost certainly clicked the highest permission level because it made the install work on the first try. Walk them back.
5. Make sure credentials are not reused across systems
280 victims lost credentials. Those credentials are only catastrophic if they unlock something else. A password manager for your team costs a few dollars a head and removes the entire class of problem where one harvested login opens four systems.
6. Know what you would do in the first hour
Who do you call. Where are the backups. How do you take a machine off the network. Write it on one page and keep it somewhere that does not require the compromised network to access.
What not to do
Do not buy an AI security product because of this story. The vendors will be in your inbox by Monday with the phrase “agentic threats” in the subject line. Nothing about this campaign was defeated or would have been defeated by a new detection layer. It was defeated, where it was defeated, by permissions and segmentation that cost nothing.
Do not conclude that AI tools are the problem. The attacker used commercially available models the same way a spammer uses email. The useful response is to assume attacker capability is now cheap and abundant, and to plan defenses that do not depend on attackers being busy elsewhere.
Do not treat this as a one time cleanup. The thing that made 395 organizations vulnerable was not a decision anyone made. It was drift: software installed years ago, permissions never revisited, a box that quietly fell off the update list. Put a recurring calendar event on it. Twice a year, walk the list.
And if you are already thinking about which of your business tools could break, get shut off, or become a liability, that is the same muscle we worked through in building a replacement map for your AI tools. Same discipline, different failure mode.
Frequently asked questions
Do I need to worry about this if I do not use PaperCut?
PaperCut was the target this time because it had two usable vulnerabilities and thousands of exposed installs. The method transfers to any widely deployed software with a known flaw. The question is not whether you run PaperCut. It is whether you run anything internet facing that you have not patched recently.
Was this a new kind of vulnerability?
No. The two PaperCut flaws were known. What was new was the speed and parallelism of exploitation. That distinction matters, because it means the fix is not exotic. It is patching and least privilege, done faster than you used to do them.
How would I even know if something like this hit me?
Most small businesses would not, at least not immediately, which is why the containment measures matter more than detection. Practical signals: unexpected admin logins, a server that suddenly has outbound traffic it never had, accounts created you do not recognize. If you have a managed IT provider, ask them today whether they monitor for lateral movement or only for malware.
Should I hire someone to audit this?
Do the free version first. The inventory, the exposure check, the permissions walk back. Most small businesses find enough in those three hours to meaningfully change their risk. If you handle client financial or health data, a paid assessment is worth it, but do the free version first so you are paying someone to find the hard problems rather than the obvious ones.
Is the attacker likely to come back?
Assume the technique is now common knowledge rather than one actor’s trick. The cost structure that made this campaign work is available to anyone, and the next one will target different software. Plan for the pattern, not the perpetrator.
Related Coverage
- Researchers Hijacked an AI Email Summarizer With Text You Cannot See. the same shift in attacker economics, aimed at your inbox instead of your server room.
- Best Password Managers for Small Teams. the cheapest fix for the credential reuse problem that turned 280 breaches into deeper ones.
- Your AI Tool Can Be Shut Off Overnight. Build the Replacement Map First.. the same inventory discipline, applied to the software you depend on.
Faceted Media Magazine covers business, AI, and entrepreneurship for the people building what’s next.