{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Pre-auth RCE in print management software allows unauthenticated attackers to obtain SYSTEM privileges; identifying exploited servers is critical to preventing environment-wide compromise." }, "name": "PaperCut NG and MF Pre-Auth RCE Exploitation", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1203", "attack.t1106", "attack.t1033", "attack.t1082", "attack.t1057", "attack.t1070.004" ], "series": { "slug": "papercut-zero-day-active-exploitation-and-pre-auth-rce", "index": 2, "title": "PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE", "total": 2 }, "related": [ { "hunt": "vulnerable-papercut-identification", "reason": "This hunt focuses on active exploitation behavior; version identification is a pure hygiene task.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple detection rule may alert on pc-app.exe spawning cmd.exe, but this hunt correlates the initial HTTP bypass, Java class drops, and anti-forensic cleanup into a multi-phased verdict to distinguish intrusions from legitimate maintenance.", "coverage": [ { "stage": "web-authorization-bypass", "steps": [ "suspicious-http-activity" ], "status": "covered" }, { "stage": "rce-java-class-loading", "steps": [ "malicious-file-drops" ], "status": "covered" }, { "stage": "post-exploitation-discovery", "steps": [ "rce-discovery-behavior" ], "status": "covered" }, { "stage": "defense-evasion-cleanup", "steps": [ "log-deletion-events" ], "status": "covered" }, { "stage": "vulnerable-asset-identification", "reason": "Belongs to another part of the 'PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Vulnerable Asset Identification", "slug": "vulnerable-asset-identification", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "PaperCut NG versions prior to 25.0.12.76497", "PaperCut MF versions prior to 25.0.12.76496", "PaperCut versions prior to 24.1.5.71847", "Internet exposure of PaperCut Management Interface on port 9191 or 9192", "CVE-2026-81578", "CVE-2026-82078" ] }, { "name": "Web Authorization Bypass", "slug": "web-authorization-bypass", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Unauthenticated HTTP requests targeting administrative components", "Specifically crafted HTTP requests with mismatched rendering and action pages" ] }, { "name": "RCE via Java Dynamic Class Loading", "slug": "rce-java-class-loading", "tactic": "execution", "techniques": [ "T1203", "T1106" ], "observables": [ "jdbc:derby:memory:pwn in connection strings", "Creation of Udydn.class in server/lib/", "Creation of Moo97.class in server/lib/", "Creation of Udydn.cmd or Udydn.out in server/data/content/", "Java bytecode execution under the PaperCut server process security context" ] }, { "name": "Post-Exploitation Discovery", "slug": "post-exploitation-discovery", "tactic": "discovery", "techniques": [ "T1033", "T1082", "T1057" ], "observables": [ "pc-app.exe spawning cmd.exe", "Execution of 'whoami & ver'", "Execution of 'whoami & ver & tasklist'", "pc-app.exe spawning charmap.exe", "Directory listings and system profiling" ] }, { "name": "Anti-Forensic Log Deletion", "slug": "defense-evasion-cleanup", "tactic": "defense-evasion", "techniques": [ "T1070.004" ], "observables": [ "Unexpected deletion or truncation of server.log", "Deletion of Udydn.out after execution", "Self-deletion of malicious .class files from server/lib/" ] } ], "summary": "Attackers are exploiting a pre-authentication remote code execution (RCE) chain in PaperCut NG and MF (CVE-2026-81578 and CVE-2026-82078) by bypassing web management authorization to modify system configurations. This vulnerability enables the loading of malicious Java bytecode via unsafe database connection strings, followed by system profiling discovery commands and anti-forensic file cleanup." }, "severity": "high", "rationale": "Start with servers identified in hb_software_inventory as PaperCut NG or MF. Prioritize those identified as internet-exposed via hb_exposed_assets.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An unauthenticated intruder has exploited PaperCut NG/MF authorization bypass and unsafe class loading to execute arbitrary Java bytecode, profiled the system, and deleted server logs to hide their activities.", "parameters": { "admin_paths": { "from": { "ref": "huntress-papercut-rce", "kind": "article", "observed": "2026-08-28" }, "type": "list[string]", "default": [ "/app", "/admin", "/setup" ], "description": "Sensitive administrative web paths targeted during bypass attempts." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-08-28" }, "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the hunt; leave empty for fleet-wide." }, "lookback_days": { "from": { "ref": "standard-policy", "kind": "manual", "observed": "2026-08-28" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "discovery_filenames": { "from": { "ref": "huntress-papercut-rce", "kind": "article", "observed": "2026-08-28" }, "type": "list[string]", "default": [ "whoami.exe", "ver.exe", "tasklist.exe", "charmap.exe", "cmd.exe" ], "description": "Standard discovery tool filenames to match against child processes." }, "malicious_filenames": { "from": { "ref": "huntress-papercut-rce", "kind": "article", "observed": "2026-08-28" }, "type": "list[path]", "default": [ "udydn.class", "moo97.class", "udydn.out", "udydn.cmd" ], "description": "Malicious filenames observed in PaperCut exploitation." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/papercut-actively-exploited", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/papercut-actively-exploited", "name": "Huntress \u2014 PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE" } ], "blind_spots": [ { "id": "no-application-log-content", "risk": "Without direct log content, we must rely on file and process side effects, potentially missing exploit attempts that do not result in a file drop.", "owner": "platform-team", "stage": "rce-java-class-loading", "question": "Can we see the specific malicious JDBC connection string?", "requires": "hb_log_activity with PaperCut server.log content", "remediation": "Ingest PaperCut application logs into the central security data lake." }, { "id": "no-process-visibility", "risk": "Legacy print servers may lack full EDR enrollment, rendering RCE discovery commands invisible.", "owner": "endpoint-team", "stage": "post-exploitation-discovery", "question": "Are child processes of pc-app.exe visible on all hosts?", "requires": "EDR process tracking on all servers", "remediation": "Audit and enforce EDR enrollment for all servers hosting print management software." } ] }, "name": "PaperCut NG and MF Pre-Auth RCE Exploitation", "description": "This hunt identifies active exploitation of PaperCut NG and MF Application Servers. It tracks the attack chain from the initial web authorization bypass and malicious file drops to the subsequent remote code execution and anti-forensic cleanup. Using a phased flow, we establish the presence of vulnerable assets and initial access artifacts before hunting for high-confidence indicators of post-exploitation profiling and log tampering." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "papercut-zero-day-active-exploitation-and-pre-auth-rce", "index": 2, "title": "PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE", "total": 2 }, "coverage": [ { "stage": "web-authorization-bypass", "steps": [ "suspicious-http-activity" ], "status": "covered" }, { "stage": "rce-java-class-loading", "steps": [ "malicious-file-drops" ], "status": "covered" }, { "stage": "post-exploitation-discovery", "steps": [ "rce-discovery-behavior" ], "status": "covered" }, { "stage": "defense-evasion-cleanup", "steps": [ "log-deletion-events" ], "status": "covered" }, { "stage": "vulnerable-asset-identification", "reason": "Belongs to another part of the 'PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE' series.", "status": "out_of_scope" } ], "rationale": "An unauthenticated intruder has exploited PaperCut NG/MF authorization bypass and unsafe class loading to execute arbitrary Java bytecode, profiled the system, and deleted server logs to hide their activities.", "blind_spots": [ { "id": "no-application-log-content", "risk": "Without direct log content, we must rely on file and process side effects, potentially missing exploit attempts that do not result in a file drop.", "owner": "platform-team", "stage": "rce-java-class-loading", "question": "Can we see the specific malicious JDBC connection string?", "requires": "hb_log_activity with PaperCut server.log content", "remediation": "Ingest PaperCut application logs into the central security data lake." }, { "id": "no-process-visibility", "risk": "Legacy print servers may lack full EDR enrollment, rendering RCE discovery commands invisible.", "owner": "endpoint-team", "stage": "post-exploitation-discovery", "question": "Are child processes of pc-app.exe visible on all hosts?", "requires": "EDR process tracking on all servers", "remediation": "Audit and enforce EDR enrollment for all servers hosting print management software." } ], "scoping_notes": "Start with servers identified in hb_software_inventory as PaperCut NG or MF. Prioritize those identified as internet-exposed via hb_exposed_assets.", "beyond_detection": "A simple detection rule may alert on pc-app.exe spawning cmd.exe, but this hunt correlates the initial HTTP bypass, Java class drops, and anti-forensic cleanup into a multi-phased verdict to distinguish intrusions from legitimate maintenance." } }, { "id": "identify-papercut-hosts", "type": "query", "label": "Identify PaperCut application servers", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%papercut ng%' OR LOWER(package_name) LIKE '%papercut mf%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_software_inventory", "description": "Define the hunt scope by identifying hosts where PaperCut NG or MF is installed.", "expected_signal": "A list of hosts running the target software; silence confirms no vulnerable assets are in scope." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify PaperCut application servers", "reads": [ "device_hostname", "package_name", "package_version", "install_path" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%papercut ng%' OR LOWER(package_name) LIKE '%papercut mf%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "evidence_of_absence", "expected": "A list of hosts running the target software; silence confirms no vulnerable assets are in scope.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "suspicious-http-activity", "type": "query", "label": "Detect unauthenticated admin access", "config": { "dsl": "sqlite", "role": "baseline", "source": "web", "content": "SELECT device_hostname, url_path, src_endpoint_ip, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (instr(',' || '{{admin_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, url_path, src_endpoint_ip HAVING request_count < 100", "surface": "hb_http_activity", "description": "Identify rare HTTP requests targeting administrative paths that may indicate an authorization bypass.", "expected_signal": "Low-frequency requests to sensitive paths from unusual source IPs." }, "parents": [ { "id": "identify-papercut-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Detect unauthenticated admin access", "reads": [ "device_hostname", "url_path", "src_endpoint_ip", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_path, src_endpoint_ip, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (instr(',' || '{{admin_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, url_path, src_endpoint_ip HAVING request_count < 100", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Low-frequency requests to sensitive paths from unusual source IPs.", "verified": "dry-run", "prevalence": { "by": "src_endpoint_ip", "key": [ "url_path" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "malicious-file-drops", "type": "query", "label": "Search for malicious Java class files", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, activity_name, time FROM hb_file_activity WHERE (instr(',' || '{{malicious_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR (LOWER(file_path) LIKE '%server\\lib\\%.class' AND activity_id = 1)) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_file_activity", "description": "Find attacker-controlled .class files in the PaperCut server library or content directories.", "expected_signal": "Creation of Java files in the application lib folder or files matching specific five-character IOC names." }, "parents": [ { "id": "identify-papercut-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Search for malicious Java class files", "reads": [ "device_hostname", "file_name", "file_path", "activity_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, activity_name, time FROM hb_file_activity WHERE (instr(',' || '{{malicious_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR (LOWER(file_path) LIKE '%server\\lib\\%.class' AND activity_id = 1)) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Creation of Java files in the application lib folder or files matching specific five-character IOC names.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "evaluate-initial-access", "type": "analytic", "label": "Evaluate early-stage indicators", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "identify-papercut-hosts", "suspicious-http-activity", "malicious-file-drops" ], "objective": "Determine if the observed HTTP activity and file creations indicate a likely PaperCut authorization bypass and class loading attempt.", "description": "Correlate identified software presence with suspicious HTTP requests and file creations to confirm the first phase of exploitation.", "max_iterations": 4, "expected_signal": "A per-host verdict on whether early exploitation artifacts are present.", "success_criteria": "Verdicts flagging hosts with overlapping HTTP and file signals as suspicious." }, "parents": [ { "id": "suspicious-http-activity", "kind": "merge" }, { "id": "malicious-file-drops", "kind": "merge" } ] }, { "id": "rce-discovery-behavior", "type": "query", "label": "Hunt for RCE discovery behavior", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%pc-app.exe%' OR LOWER(parent_process_name) LIKE '%java.exe%') AND (instr(',' || '{{discovery_filenames}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_process_activity", "description": "Identify system discovery commands executed by the PaperCut Application Server process or its Java children.", "expected_signal": "Child processes of the PaperCut server running profiling tools like whoami, ver, or tasklist." }, "parents": [ { "id": "evaluate-initial-access" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Hunt for RCE discovery behavior", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%pc-app.exe%' OR LOWER(parent_process_name) LIKE '%java.exe%') AND (instr(',' || '{{discovery_filenames}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Child processes of the PaperCut server running profiling tools like whoami, ver, or tasklist.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "log-deletion-events", "type": "query", "label": "Monitor for anti-forensic cleanup", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, activity_name, time FROM hb_file_activity WHERE LOWER(file_name) = 'server.log' AND activity_id = 4 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_file_activity", "description": "Detect the deletion of the PaperCut server log, a specific tactic used by attackers to hide the RCE payload.", "expected_signal": "The deletion of server.log following suspicious process activity on the same PaperCut server." }, "parents": [ { "id": "evaluate-initial-access" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Monitor for anti-forensic cleanup", "reads": [ "device_hostname", "file_name", "file_path", "process_name", "activity_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, activity_name, time FROM hb_file_activity WHERE LOWER(file_name) = 'server.log' AND activity_id = 4 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "The deletion of server.log following suspicious process activity on the same PaperCut server.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "evaluate-full-compromise", "type": "analytic", "label": "Evaluate full exploitation chain", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "evaluate-initial-access", "rce-discovery-behavior", "log-deletion-events" ], "objective": "Confirm the presence of a full exploit chain by correlating the initial access verdict with discovery and anti-forensic cleanup results.", "description": "Synthesize early access signals with follow-on RCE behavior and cleanup to confirm a successful intrusion.", "max_iterations": 6, "expected_signal": "A comprehensive per-host verdict linking the entire attack chain.", "success_criteria": "Verdicts identifying hosts where the full chain from bypass to profiling and cleanup is confirmed." }, "parents": [ { "id": "rce-discovery-behavior", "kind": "merge" }, { "id": "log-deletion-events", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the evaluate-full-compromise verdict is malicious for at least one host", "condition": "the evaluate-full-compromise verdict is malicious for at least one host", "blind_spot": "no-process-visibility", "confidence": "high", "description": "Direct the hunt results to response or manual review based on the synthesized verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "evaluate-full-compromise" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Prevent lateral movement and further data theft from confirmed compromised PaperCut servers.", "instructions": "Isolate the host immediately via the EDR. Preserve the 'server/logs' directory and capture any unidentified .class files before remediation.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "manual-forensics", "type": "task", "label": "Manual forensics", "config": { "assignee": "analyst", "description": "Analyze logs and on-disk artifacts for deeper indicators of compromise.", "instructions": "Review PaperCut application logs for 'jdbc:derby:memory:pwn' strings and entries for irregular database names. Inspect 'server/lib' and 'server/data/content' for unauthorized five-character .class or .cmd files." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Ensure the environment is patched and secure after the hunt.", "instructions": "Confirm all PaperCut NG/MF servers are updated to Emergency Release 3. Verify that management interfaces are restricted to trusted internal networks." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "manual-forensics" } ] } ] }