Exploiting PaperCut NG/MF Vulnerabilities in Phishing Campaigns

In this article, we’ll dissect recent phishing campaigns targeting vulnerabilities in PaperCut NG/MF, particularly CVE-2026-82078 and CVE-2026-81578. These vulnerabilities have been exploited extensively, as documented in the CISA catalog of known vulnerabilities. Our focus will be on how attackers leverage these weaknesses to manipulate system configurations and gain unauthorized access, with implications for organizations using these services.

Campaign or TTP Overview

The campaign targeting PaperCut NG/MF vulnerabilities emerged in mid-2023, focusing on enterprises in the education and government sectors across North America and Europe. The attackers, whose origins remain unconfirmed, likely operated with financial motivations as their primary target was system disruption followed by ransom demands.

Utilizing known vulnerabilities in PaperCut NG/MF systems, the attackers crafted phishing campaigns that impersonated IT support departments. This targeted approach capitalized on existing security gaps within organizations to deploy malware payloads and manipulate sensitive configurations.

Exploiting specific technical vulnerabilities in widely-used software can offer attackers a high-yield attack vector, especially when combined with sophisticated social engineering techniques.

How It Was Built

The attackers employed a carefully structured phishing scheme, setting up infrastructure such as phishing domains and email servers that mimicked legitimate IT departments. The domain pattern often included subdomains mirroring official URLs, like

support-its.exampleorg.com

, enhancing the illusion of authenticity.

Emails were sent from sender identities like

it-support@companymail.com

, with subjects crafted to instill urgency. A common subject line used was “Action Required: Critical Security Update on Your Account”. These emails contained links to well-crafted, clone phishing pages designed to capture user credentials under the pretense of a security update patch.

Subject: Action Required: Critical Security Update on Your Account

From: IT Support <it-support@companymail.com>

To: Victim <victim@targetorg.com>

Dear User,

We've detected potential vulnerabilities in your account associated with PaperCut NG/MF. To prevent unauthorized access, please follow the link below to install the latest security update:

[Install Update]

Thank you,

IT Support Team

The final stage involved deploying scripts to exploit the vulnerabilities, solidifying access to the compromised systems. This payload executed commands to escalate privileges within the application, allowing the attackers to alter configurations and access sensitive data.

Why It Worked

Several factors contributed to the effectiveness of this phishing campaign:

Realistic Impersonation: The attackers used spoofed email addresses closely aligned with those of real IT support teams, leveraging trust and familiarity.
Timeliness and Relevance: By timing the emails around known vulnerability disclosures, the attackers enhanced their legitimacy, aligning their narrative with plausible IT department activities.
Domain and Branding Consistency: Use of subdomains closely resembling genuine addresses added a layer of credibility, reducing the likelihood of detection by casual scrutiny.

These elements combined to ensure that recipients were more likely to engage with the content, clicking links, and entering credentials without immediate suspicion.

Operator Takeaways

For red teamers seeking to test an organization’s readiness, this campaign offers several tactics to replicate:

Effective Social Engineering: Crafting email content that resonates with the target’s current concerns can significantly increase engagement. Using IT-centric narratives, particularly around need-based access or updates, can prove beneficial.
Domain Spoofing Techniques: Carefully constructed domains that mimic official URLs can bypass initial user scrutiny. Safely practicing DNS-based deception enhances the realism of the campaign.

Good / Better / Best

This section offers a tiered approach to executing phishing simulations based on the discussed real-world campaign.

Good: Deploy basic email lures with straightforward calls to action. Even simple impersonation of support messages can yield results.
Better: Incorporate tailored branding elements and contextually relevant timing into your campaign to increase realism and engagement.
Best: Use targeted, data-driven social engineering techniques—perhaps leveraging known organizational behaviors or recent updates—to create a highly personalized attack vector.

References

For more information on the vulnerabilities exploited in this campaign and others, refer to these resources:

CISA’s Known Exploited Vulnerabilities Catalog