Inside a PaperCut attacker’s AI toolkit: custom Rust collectors, chisel persistence, and AI-directed exploitation using 25 concurrent agents

[u/Straight-Practice-99]

https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce

Three open directories on the PaperCut campaign server exposed the operator's full toolkit.

The tooling included four custom Rust Windows binaries for LSA secret collection and registry hive dumping, Python scripts for offline NT hash recovery and service credential parsing, and a chisel-based Linux persistence mechanism with cron. The exploit framework had three variants targeting different PaperCut versions, with version auto-detection and automatic cleanup of modified config values after each run.

The whole operation was orchestrated by a DeepSeek AI model through the OpenAI Codex harness, with a 19KB instruction file directing up to 25 concurrent subagents.

MD5 hashes and full analysis: https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce