Zero-Days in PaperCut MF Chained to Compromise Active Directory in Education Sector

Analysts from eSentire have detailed a sophisticated intrusion that chained two zero-day vulnerabilities in PaperCut MF to reach the domain controller of an education-sector organization in less than two days.

The entry point was the card or badge query field. Attackers used it to deliver malicious Java code that enabled unauthenticated configuration changes and arbitrary bytecode execution on version 24.0.2 of the product. The flaws are tracked as CVE-2026-81578 and CVE-2026-82078.

The first-stage loader reassembled payload fragments directly in memory, started the next stage, and then deleted its own files. It was designed to operate across different versions of Tomcat. The subsequent web shell accepted commands through a custom HTTP header, read configuration data, and wiped its own log traces while sitting early in the request-processing pipeline, thereby blocking competing exploitation attempts by other groups.

The command-and-control implant was AdaptixC2, concealed inside a modified Microsoft Copilot binary downloaded from infrastructure hosted on Alibaba Cloud. After initial contact the implant remained silent for approximately 24 hours before operators resumed manual activity.

Privilege escalation required no password. The attackers located a domain-privileged service account running as an active process, copied its access token, and relaunched the implant with those elevated rights. On the domain controller the payload was delivered via administrative share and executed by temporarily altering the Windows PlugPlay service; the original service path was restored shortly afterward to reduce forensic evidence.

Once inside the domain controller the operators extracted credentials from memory and the registry, enabled Restricted Admin mode, used an NTLM hash to access systems via RDP, and copied the entire Active Directory database containing password hashes for all domain accounts.