Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Summary

Threat actors are actively chaining two PaperCut vulnerabilities to steal credentials across educational institutions. Researchers documented extensive post-exploitation activity including account creation, command execution, and extraction of system BootKeys from Windows registries.

Key Takeaways

1. Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe.
2. The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypass and remote code execution chain – to conduct command execution and reconnaissance, as well as create privileged accounts.
3. Users are advised to restrict PaperCut servers from being exposed to the internet and monitor for the execution of cmd.exe, powershell.exe, or other scripting and command interpreters, along with commands containing whoami, tasklist, ver, or uname -a with pc-app.exe as the parent process.

Statement Breakdown

• Claimed Facts: 85% of statements the article presents as facts
• Opinions: 10% of statements classified as editorial or subjective
• Claims: 5% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The reporting relies directly on concrete technical telemetry and post-exploitation findings from Arctic Wolf Adversary Research Team. Indicators of compromise, specific CVE identifiers, commands, and IP addresses are documented precisely. The technical advice aligns directly with established cybersecurity incident response practices.

Bias assessment: Technical Cybersecurity Reporting. The text maintains an objective, technical tone focused on vulnerability details and observed exploitation. It presents factual observations from security researchers without sensationalism. The analysis centers purely on threat mechanics and defensive mitigation steps.

Note: Findings are based on research from Arctic Wolf detailing ongoing exploitation of PaperCut vulnerabilities.

Credibility flag: High Technical Rigor

Claimed Facts (5)

• States verifiable reporting on active cyberattacks targeting specific software across educational organizations.
• Presents specific technical vulnerability identifiers and observed malicious actions documented by threat researchers.
• Direct quotation specifying exact toolsets and payloads observed during post-exploitation research.
• Specifies the institutional scope and geographic footprint of the confirmed attacks.
• Describes specific malware behavior verified through sandbox malware analysis.

Opinions (5)

• Represents an assessment by security analysts regarding potential downstream security impacts.
• Expresses expert defensive guidance and security recommendations.
• Editorial categorization introducing a non-exhaustive list of indicators.
• Synthesized observation describing operational tactics of the threat actors.
• Synthesized pattern identification detailing threat actor hunting techniques.

Claims (5)

• Presents specific network indicators and payload paths that require independent validation across varied environments.
• Documents specific binary delivery mechanisms that may reflect limited incident telemetry rather than universal adversary behavior.
• Contains point-in-time adversary infrastructure indicators which may quickly rotate or produce false positives.
• References newly disclosed vulnerability identifiers under active investigation.
• Broad generalization regarding threat campaigns that requires sustained confirmation from multiple response firms.

Key Sources

• Arctic Wolf Adversary Research Team — Threat intelligence and cybersecurity research unit
• The Hacker News — Cybersecurity news publication