PaperCut NG and MF Pre-Auth RCE Exploitation

Source

---
analysis: A simple detection rule may alert on pc-app.exe spawning cmd.exe, but this
  hunt correlates the initial HTTP bypass, Java class drops, and anti-forensic cleanup
  into a multi-phased verdict to distinguish intrusions from legitimate maintenance.
blind_spots:
- id: no-application-log-content
  owner: platform-team
  question: Can we see the specific malicious JDBC connection string?
  remediation: Ingest PaperCut application logs into the central security data lake.
  requires: hb_log_activity with PaperCut server.log content
  risk: Without direct log content, we must rely on file and process side effects,
    potentially missing exploit attempts that do not result in a file drop.
  stage: rce-java-class-loading
- id: no-process-visibility
  owner: endpoint-team
  question: Are child processes of pc-app.exe visible on all hosts?
  remediation: Audit and enforce EDR enrollment for all servers hosting print management
    software.
  requires: EDR process tracking on all servers
  risk: Legacy print servers may lack full EDR enrollment, rendering RCE discovery
    commands invisible.
  stage: post-exploitation-discovery
coverage:
- stage: web-authorization-bypass
  status: covered
  steps:
  - suspicious-http-activity
- stage: rce-java-class-loading
  status: covered
  steps:
  - malicious-file-drops
- stage: post-exploitation-discovery
  status: covered
  steps:
  - rce-discovery-behavior
- stage: defense-evasion-cleanup
  status: covered
  steps:
  - log-deletion-events
- reason: 'Belongs to another part of the ''PaperCut Zero-Day: Active Exploitation
    and Pre-Auth RCE'' series.'
  stage: vulnerable-asset-identification
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: Pre-auth RCE in print management software allows unauthenticated
    attackers to obtain SYSTEM privileges; identifying exploited servers is critical
    to preventing environment-wide compromise.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An unauthenticated intruder has exploited PaperCut NG/MF authorization
  bypass and unsafe class loading to execute arbitrary Java bytecode, profiled the
  system, and deleted server logs to hide their activities.
labels:
- hunt
- attack.t1190
- attack.t1203
- attack.t1106
- attack.t1033
- attack.t1082
- attack.t1057
- attack.t1070.004
name: PaperCut NG and MF Pre-Auth RCE Exploitation
parameters:
  admin_paths:
    default:
    - /app
    - /admin
    - /setup
    description: Sensitive administrative web paths targeted during bypass attempts.
    from:
      kind: article
      observed: '2026-08-28'
      ref: huntress-papercut-rce
    type: list[string]
  discovery_filenames:
    default:
    - whoami.exe
    - ver.exe
    - tasklist.exe
    - charmap.exe
    - cmd.exe
    description: Standard discovery tool filenames to match against child processes.
    from:
      kind: article
      observed: '2026-08-28'
      ref: huntress-papercut-rce
    type: list[string]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2026-08-28'
      ref: standard-policy
    type: number
  malicious_filenames:
    default:
    - udydn.class
    - moo97.class
    - udydn.out
    - udydn.cmd
    description: Malicious filenames observed in PaperCut exploitation.
    from:
      kind: article
      observed: '2026-08-28'
      ref: huntress-papercut-rce
    type: list[path]
  scope_hosts:
    default: []
    description: Optional list of hostnames to focus the hunt; leave empty for fleet-wide.
    from:
      kind: manual
      observed: '2026-08-28'
      ref: analyst-scoping
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.huntress.com/blog/papercut-actively-exploited
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: Start with servers identified in hb_software_inventory as PaperCut NG or
  MF. Prioritize those identified as internet-exposed via hb_exposed_assets.
references:
- name: "Huntress \u2014 PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE"
  url: https://www.huntress.com/blog/papercut-actively-exploited
related:
- hunt: vulnerable-papercut-identification
  reason: This hunt focuses on active exploitation behavior; version identification
    is a pure hygiene task.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Vulnerable Asset Identification
    observables:
    - PaperCut NG versions prior to 25.0.12.76497
    - PaperCut MF versions prior to 25.0.12.76496
    - PaperCut versions prior to 24.1.5.71847
    - Internet exposure of PaperCut Management Interface on port 9191 or 9192
    - CVE-2026-81578
    - CVE-2026-82078
    slug: vulnerable-asset-identification
    tactic: initial-access
    techniques:
    - T1190
  - name: Web Authorization Bypass
    observables:
    - Unauthenticated HTTP requests targeting administrative components
    - Specifically crafted HTTP requests with mismatched rendering and action pages
    slug: web-authorization-bypass
    tactic: initial-access
    techniques:
    - T1190
  - name: RCE via Java Dynamic Class Loading
    observables:
    - jdbc:derby:memory:pwn in connection strings
    - Creation of Udydn.class in server/lib/
    - Creation of Moo97.class in server/lib/
    - Creation of Udydn.cmd or Udydn.out in server/data/content/
    - Java bytecode execution under the PaperCut server process security context
    slug: rce-java-class-loading
    tactic: execution
    techniques:
    - T1203
    - T1106
  - name: Post-Exploitation Discovery
    observables:
    - pc-app.exe spawning cmd.exe
    - Execution of 'whoami & ver'
    - Execution of 'whoami & ver & tasklist'
    - pc-app.exe spawning charmap.exe
    - Directory listings and system profiling
    slug: post-exploitation-discovery
    tactic: discovery
    techniques:
    - T1033
    - T1082
    - T1057
  - name: Anti-Forensic Log Deletion
    observables:
    - Unexpected deletion or truncation of server.log
    - Deletion of Udydn.out after execution
    - Self-deletion of malicious .class files from server/lib/
    slug: defense-evasion-cleanup
    tactic: defense-evasion
    techniques:
    - T1070.004
  summary: Attackers are exploiting a pre-authentication remote code execution (RCE)
    chain in PaperCut NG and MF (CVE-2026-81578 and CVE-2026-82078) by bypassing web
    management authorization to modify system configurations. This vulnerability enables
    the loading of malicious Java bytecode via unsafe database connection strings,
    followed by system profiling discovery commands and anti-forensic file cleanup.
series:
  index: 2
  slug: papercut-zero-day-active-exploitation-and-pre-auth-rce
  title: 'PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE'
  total: 2
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# PaperCut NG and MF Pre-Auth RCE Exploitation

This hunt identifies active exploitation of PaperCut NG and MF Application Servers. It tracks the attack chain from the initial web authorization bypass and malicious file drops to the subsequent remote code execution and anti-forensic cleanup. Using a phased flow, we establish the presence of vulnerable assets and initial access artifacts before hunting for high-confidence indicators of post-exploitation profiling and log tampering.

## identify-papercut-hosts
<!-- Identify PaperCut application servers -->
Define the hunt scope by identifying hosts where PaperCut NG or MF is installed.

```sqlite target=endpoint role=scoping params=(scope_hosts=scope_hosts)
~~~yaml
expected: A list of hosts running the target software; silence confirms no vulnerable
  assets are in scope.
reads:
- device_hostname
- package_name
- package_version
- install_path
silence: evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%papercut ng%' OR LOWER(package_name) LIKE '%papercut mf%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## initial-access-gathering
<!-- Gather initial access evidence -->
parallel:
- → suspicious-http-activity
- → malicious-file-drops
join: → evaluate-initial-access

## suspicious-http-activity
<!-- Detect unauthenticated admin access -->
Identify rare HTTP requests targeting administrative paths that may indicate an authorization bypass.

```sqlite target=web role=baseline params=(admin_paths=admin_paths, lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Low-frequency requests to sensitive paths from unusual source IPs.
prevalence:
  by: src_endpoint_ip
  key:
  - url_path
  rare_below: 5
reads:
- device_hostname
- url_path
- src_endpoint_ip
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, url_path, src_endpoint_ip, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (instr(',' || '{{admin_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, url_path, src_endpoint_ip HAVING request_count < 100
```

## malicious-file-drops
<!-- Search for malicious Java class files -->
Find attacker-controlled .class files in the PaperCut server library or content directories.

```sqlite target=endpoint role=enrichment params=(malicious_filenames=malicious_filenames, lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Creation of Java files in the application lib folder or files matching specific
  five-character IOC names.
reads:
- device_hostname
- file_name
- file_path
- activity_name
- time
silence: not_evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, file_name, file_path, activity_name, time FROM hb_file_activity WHERE (instr(',' || '{{malicious_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR (LOWER(file_path) LIKE '%server\lib\%.class' AND activity_id = 1)) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## evaluate-initial-access
<!-- Evaluate early-stage indicators -->
```agent target=hunter
cite: required
context:
- identify-papercut-hosts
- suspicious-http-activity
- malicious-file-drops
max_iterations: 4
objective: Determine if the observed HTTP activity and file creations indicate a likely
  PaperCut authorization bypass and class loading attempt.
success_criteria: Verdicts flagging hosts with overlapping HTTP and file signals as
  suspicious.
tools:
- endpoint
- web
```

## follow-on-exploitation
<!-- Assess follow-on exploitation -->
parallel:
- → rce-discovery-behavior
- → log-deletion-events
join: → evaluate-full-compromise

## rce-discovery-behavior
<!-- Hunt for RCE discovery behavior -->
Identify system discovery commands executed by the PaperCut Application Server process or its Java children.

```sqlite target=endpoint role=detection-candidate params=(discovery_filenames=discovery_filenames, lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Child processes of the PaperCut server running profiling tools like whoami,
  ver, or tasklist.
reads:
- device_hostname
- process_name
- process_cmd_line
- parent_process_name
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%pc-app.exe%' OR LOWER(parent_process_name) LIKE '%java.exe%') AND (instr(',' || '{{discovery_filenames}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## log-deletion-events
<!-- Monitor for anti-forensic cleanup -->
Detect the deletion of the PaperCut server log, a specific tactic used by attackers to hide the RCE payload.

```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: The deletion of server.log following suspicious process activity on the
  same PaperCut server.
reads:
- device_hostname
- file_name
- file_path
- process_name
- activity_name
- time
silence: not_evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, file_name, file_path, process_name, activity_name, time FROM hb_file_activity WHERE LOWER(file_name) = 'server.log' AND activity_id = 4 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## evaluate-full-compromise
<!-- Evaluate full exploitation chain -->
```agent target=hunter
cite: required
context:
- evaluate-initial-access
- rce-discovery-behavior
- log-deletion-events
max_iterations: 6
objective: Confirm the presence of a full exploit chain by correlating the initial
  access verdict with discovery and anti-forensic cleanup results.
success_criteria: Verdicts identifying hosts where the full chain from bypass to profiling
  and cleanup is confirmed.
tools:
- endpoint
- web
```

## route-on-verdict
<!-- Route on verdict -->
if~: "the evaluate-full-compromise verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → manual-forensics
unavailable: → manual-forensics (blind_spot: no-process-visibility)
else: → close-out

## isolate-host
<!-- Isolate host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host immediately via the EDR. Preserve the 'server/logs' directory and capture any unidentified .class files before remediation.
```
→ manual-forensics

## manual-forensics
<!-- Manual forensics -->
```manual target=analyst
Review PaperCut application logs for 'jdbc:derby:memory:pwn' strings and entries for irregular database names. Inspect 'server/lib' and 'server/data/content' for unauthorized five-character .class or .cmd files.
```
→ close-out

## close-out
<!-- Close out -->
```manual target=analyst
Confirm all PaperCut NG/MF servers are updated to Emergency Release 3. Verify that management interfaces are restricted to trusted internal networks.
```
→ end