Currently, attackers are targeting a security vulnerability in PaperCut NG/MF. There is no concrete information the vulnerability yet. Versions secured against attacks are available for download.
Companies use PaperCut NG/MF for print management. The software is repeatedly targeted by attackers. For example, in April of this year , attackers were able to bypass authentication by successfully exploiting a security vulnerability.
In a warning message, the developers advise an immediate update . They state that versions v25 and v26 for Linux, macOS, and Windows have been fixed. V24 is expected to follow.
In addition to installing the security patch, they advise admins to restrict access via firewall rules to trusted devices if instances are publicly accessible.
The extent of the attacks is currently unknown. It is also unclear what the security vulnerability is and what attackers can specifically do after successful attacks. Due to the urgent warning from the developers, the danger is obviously very high. Currently, there is no CVE number for the vulnerability, and an assessment of the threat level is also pending.
In the warning message, the developers provide initial indicators (Indicator of Compromise, IoC) that admins can use to identify attacked systems. However, they explicitly point out that systems can still be compromised even if none of the IoCs are found. The developers intend to update the warning message later with more IoCs.
So far, admins need to look for suspicious activities in the context of the PaperCut Application Server, especially pc-app.exe, deleted logs, and the following log entries:
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
