Executive SummaryRisk level: High
What happened

Malicious actors are exploiting two vulnerabilities in PaperCut NG and MF to execute arbitrary code remotely. These flaws allow unauthenticated access to the application’s trusted configuration.

Who is affected

Organizations running affected versions of PaperCut NG and MF are at risk, particularly those that have not applied the latest security updates.

Why it matters

The ability to execute arbitrary code without authentication can lead to severe security breaches, including data theft, system compromise, and operational disruption.

Immediate recommended actions

  • Apply the latest patches from PaperCut immediately.
  • Review configurations for unauthorized changes or accesses.
  • Implement enhanced monitoring for unusual activities related to PaperCut.

Key Technical Findings

Vulnerability / Campaign Type

Exploitation of vulnerabilities in PaperCut NG and MF leading to arbitrary code execution.

Affected Systems

PaperCut NG and MF versions prior to the latest patch.

Initial Access Vector

Remote exploitation via the application interface without authentication.

Execution Method

Code execution through manipulation of trusted configurations.

Persistence

Not specified in the source material.

Privilege Escalation

Not specified in the source material.

Defense Evasion

Not specified in the source material.

Credential Access

Not specified in the source material.

Lateral Movement

Not specified in the source material.

Data Exfiltration

Not specified in the source material.

Impact Level

Severe impact due to potential full system compromise.

Technical Background

The vulnerabilities in PaperCut NG and MF allow attackers to exploit trusted configurations of the application, leading to arbitrary code execution. This vulnerability type is particularly dangerous as it does not require any authentication, enabling threat actors to manipulate configurations seamlessly. The security flaw could lead to unauthorized access to sensitive data and control over the application, posing a critical risk to organizational operations.

Typical attacker objectives include gaining control over vulnerable systems to deploy further malicious payloads, exfiltrating sensitive data, or using these systems as pivot points for lateral movement within the network. The impact of such exploits can be profound, affecting not only the integrity and availability of the application but also potentially compromising broader organizational security controls.

Attack Chain Analysis

  1. Initial Access

    ActivityRemote exploitation of vulnerabilities in PaperCut applications.

    EvidenceUnusual access patterns on application logs indicating unauthorized changes.

    TelemetryApplication access logs, system error logs indicating unexpected activities.

    Detection opportunityMonitor for anomalous access attempts on PaperCut endpoints.

  2. Execution

    ActivityArbitrary code execution through manipulation of application configurations.

    EvidenceExecution of unexpected Java processes related to PaperCut.

    TelemetryProcess execution logs showing unrecognized commands.

    Detection opportunityAnalyze process execution logs for unauthorized commands or scripts running under PaperCut’s context.

Deep Technical Behavior Analysis

The attack leverages specific vulnerabilities within the Java-based architecture of PaperCut. Attackers may utilize techniques such as reflective loading or dynamic code execution to bypass standard security measures in place. This behavior could manifest as unexpected Java threads or processes executing outside normal operational parameters, raising flags for security monitoring solutions.

Potential indicators of such behavior include deviations from baseline process behavior or unusual memory usage patterns associated with the PaperCut service. Enhanced telemetry around Java process invocation can aid in detecting potential exploitation attempts early. Continuous monitoring is necessary to validate these behaviors against known attack patterns.

Indicators of Compromise

No indicators of compromise were provided in the source material.

Indicators of Behavior

Behavioral Indicator Description Data Source Confidence
Unauthorized Configuration Changes Changes to PaperCut settings without legitimate authorization. Application logs, configuration management tools. Potential

Detection Engineering Guidance

T1071.001 — Application Layer Protocol: Web Protocols
  • ObjectiveDetect unauthorized access attempts and command executions.
  • Suspicious patternRepeated access attempts with unusual user agents or IP addresses.
  • Data sourceWeb server logs, application access logs.
  • False positivesUser agents that are common among legitimate users may trigger false alarms.
  • ResponseInvestigate unusual access patterns and assess for potential exploitation attempts.
index=web_logs (status_code!=200 OR user_agent=







Platform
Log Source
What to Look For
Priority






Endpoint
EDR / Defender telemetry
Process tree, persistence, tamper attempts
High




Web
Web server access logs
Anomalous POSTs, new endpoints, web-shell-like requests
High




Web
Web server error logs
Repeated 403/404/500 bursts on single endpoints
Medium




Cloud
CloudTrail / Azure AD / GCP audit
IAM/OAuth changes, key creation, role grants, sign-ins
High




Identity
IdP / VPN logs
Impossible travel, spraying, MFA fatigue
High




Network
DNS resolver logs
Rare/high-entropy domains, tunneling
Medium




Network
Proxy / firewall logs
Beaconing, direct-IP C2, exfil volume
High






MITRE ATT&CK Mapping






Tactic
Technique ID
Technique Name
Relevance
Detection Opportunity
Confidence






Command and Control
T1071.001
Application Layer Protocol
Relevant to the analyzed activity.
Monitor associated telemetry (see Detection Engineering).
Reported






Incident Response Guidance


    

  • Validate exposure and confirm whether the issue applies to your environment.
    • 

  • Preserve evidence (memory, disk, relevant logs) before remediation.
    • 

  • Isolate affected hosts/accounts if compromise is suspected.
    • 

  • Collect volatile data and review the log sources listed above.
    • 

  • Hunt for the indicators of behavior and any related atomic indicators.
    • 

  • Rotate potentially exposed credentials, keys, and session tokens.
    • 

  • Remove persistence (tasks, services, keys, web shells, cron, OAuth grants).
    • 

  • Patch affected systems; reimage where integrity cannot be assured.
    • 

  • Run post-remediation validation and a BAS/security-validation retest.
    • 



Remediation and Hardening


    

  • Patch affected systems and reduce internet-exposed services.
    • 

  • Enforce MFA and least-privilege for privileged and remote access.
    • 

  • Improve endpoint telemetry (Sysmon/EDR) and PowerShell logging.
    • 

  • Restrict script execution and constrain LOLBins where feasible.
    • 

  • Monitor persistence locations and disable unnecessary services.
    • 

  • Segment critical assets and review privileged accounts.
    • 

  • Rotate secrets and remove credentials from configuration files.
    • 

  • Tune SIEM/EDR detections, then validate controls after changes.
    • 



Business Risk


    

  • Service disruption: degraded or unavailable systems during compromise or recovery.
    • 

  • Data exposure: risk to sensitive, regulated, or customer data depending on scope.
    • 

  • Regulatory exposure: potential breach-notification and compliance obligations.
    • 

  • Financial impact: incident response, downtime, and potential extortion costs.
    • 

  • Brand and trust impact: reputational damage with customers and partners.
    • 

  • Identity blast radius: compromised accounts can expand access across cloud and SaaS.
    • 



Executive Takeaway




What leadership needs to know: Reducing exposure and improving detection coverage limits impact. Current assessed risk: Not specified.


Prioritise: patching/exposure reduction, identity hardening (MFA, least privilege), and detection coverage for the techniques above.


Validate after remediation: re-test controls with breach & attack simulation to confirm the relevant techniques are now prevented or detected.

Validate your defenses against this attack

The techniques in this article map directly to Valitrix validation modules — test your own controls against them:

  • Endpoint Security Validation

    Verify your EDR, XDR and AV controls actually detect the endpoint techniques used by this threat.

  • SIEM Validation

    Confirm your SIEM and detection rules fire on the attack behaviors covered in this article.

  • BAS testing

    Safely replay the same attack techniques against your own environment — non-disruptive and evidence-based.

#arbitrary code execution#attack simulation#Breach Simulation#CVE#cybersecurity#MITRE ATT&CK#PaperCut#red teaming#security control validation#security hardening#SOC#Threat Detection#Threat Intelligence#Vulnerabilities#vulnerability

Written by

Valitrix

Valitrix writes for Valitrix on continuous Breach and Attack Simulation, MITRE ATT&CK-aligned validation, and hardening security controls across endpoint, email, and network surfaces.

Back to all posts