The **Arctic Wolf Adversary Research Team** has reported ongoing exploitation of **PaperCut** vulnerabilities, targeting the education sector in the U.S. and Europe. The attacks chain **CVE-2026-81578** (authentication bypass) and **CVE-2026-82078** (remote code execution) to achieve command execution and reconnaissance, ultimately leading to the creation of privileged accounts.  ### Post-Exploitation Tactics **Arctic Wolf** detailed the post-exploitation activities, which include a range of malicious actions: * **Discovery Commands**: Execution of `uname`, `whoami`, `ver`, and `tasklist` to gather system information. * **Account Creation**: Creation of new privileged accounts, such as "Administrator17." * **Data Exfiltration**: Inbound GET requests from IP address `45.142.193[.]132` for `/custom/pcp_*.txt` and `/custom/web/pcp_*.txt` files, likely containing harvested system and user data. * **Credential Harvesting**: Delivery of tools like `lsa_collect.exe`, `lsa_collect_small.exe`, and `save_hives.exe` via `certutil.exe` from `45.142.193[.]132`. * **Payload Delivery**: Retrieval of **Meterpreter** Java payloads from `194.180.48[.]134` to establish command-and-control sessions. * **Configuration File Analysis**: Use of `findstr` to search **PaperCut** configuration files for sensitive keywords such as "password," "secret," "ldap," "bind," and "token." ### Accessing the SAM Database **Arctic Wolf** also observed `lsa_collect.exe` in a sandbox environment extracting specific registry keys. This process aims to reconstruct the system **BootKey**, which can then grant attackers access to the **Security Account Manager (SAM)** database, a critical repository of user credentials. "The concern is that those stolen logins could give attackers a pathway into other critical systems across the environment," **Arctic Wolf** stated, emphasizing the potential for broader compromise beyond the initial **PaperCut** server. ### Mitigation Recommendations Organizations are strongly advised to restrict **PaperCut** servers from direct exposure to the internet. Furthermore, it is crucial to monitor for suspicious process execution, specifically `cmd.exe`, `powershell.exe`, or other scripting and command interpreters. Special attention should be given to commands containing `whoami`, `tasklist`, `ver`, or `uname -a` when `pc-app.exe` is the parent process.