If your business uses PaperCut to manage office printing – and thousands of Australian schools, councils, medical practices and small offices do, since it’s an Australian-founded product – a recent attack should get your attention. Security researchers have revealed that a cybercriminal, believed to be Russian-speaking, used hundreds of AI agents working in parallel to automatically find and exploit a known flaw in PaperCut NG/MF software, breaking into more than 440 separate installations.
What makes this different from the usual “vulnerability found, patch released” story is the speed and scale. Instead of one hacker manually testing target after target, AI tools were set loose to do the scanning, exploiting and breaking-in work simultaneously across hundreds of systems. That’s a preview of where cyberattacks are heading, and it has real implications for small and medium businesses in regional Victoria who assume they’re “too small to be a target.”
PaperCut is print management software used widely in offices, schools, libraries and government sites to track and control printing. A pair of security flaws in PaperCut NG/MF were disclosed recently, and rather than being exploited slowly by hand, they were quickly weaponised using AI-driven automation. Researchers at Blackpoint Cyber and GreyNoise traced the activity to a single IP address that has been used to hammer away at vulnerable systems using AI agents to generate and refine exploit code on the fly.
The result was hundreds of compromised servers in a very short window – a scale that would have taken a human attacker far longer to achieve manually. Once an attacker has a foothold on a print server, they typically have a path deeper into the network, since print servers often have elevated permissions and are rarely monitored as closely as a company’s main file or email servers.
The specific software here is PaperCut, but the real lesson is bigger than one product. This incident, reported by The Hacker News, is a clear signal that the gap between “a vulnerability is announced” and “criminals are actively exploiting it at scale” is shrinking fast, because attackers are now using AI to do the grunt work of finding and hitting exposed systems.
For years, small businesses have had a rough safety net: attackers usually went after big, high-value targets first, and by the time smaller businesses were targeted, patches had often been applied. AI-assisted attacks remove that safety net. A tool that can test thousands of systems for a known flaw doesn’t care whether you’re a 200-seat corporate office or a five-person accounting firm in Sale or Traralgon – if your software is unpatched and reachable from the internet, you’re a target of opportunity.
Print servers, like a lot of “background” business software, tend to get installed once and then forgotten. Nobody thinks about print management software the way they think about their email or their accounting system, so patches get missed, and the server quietly sits there, sometimes accessible from outside the office network for remote printing or vendor support reasons.
That’s exactly the kind of system attackers – human or AI-assisted – love to find. It’s often running with high privileges, it’s rarely the first thing an IT provider is asked to check, and a compromise can go unnoticed for weeks.
You don’t need to become a security expert to protect yourself from this kind of attack. The response is mostly about discipline and visibility rather than technical wizardry.
It’s worth being clear-eyed about what’s changing. AI isn’t creating brand new categories of vulnerability here – the PaperCut flaw itself is a fairly conventional software bug. What’s changed is the speed at which that bug gets turned into a working, scaled attack once it’s public. Where a manual attack might have taken a criminal days or weeks to test against a handful of targets, AI agents can attempt exploitation against hundreds of systems almost simultaneously, refining their approach as they go.
This means the old advice to “patch within a reasonable timeframe” needs updating to “patch as soon as practically possible, especially for anything reachable from the internet.” The window between a vulnerability becoming public and it being actively exploited against smaller, less-defended businesses is compressing.
You don’t need enterprise-grade security tools to meaningfully reduce your risk. Most of what protects a small business from incidents like this comes down to basic hygiene done consistently: an accurate inventory of your systems, a habit of patching promptly, sensible network segmentation, and backups that actually get tested. None of that is glamorous, but it’s exactly what stops an opportunistic, automated attack from turning into a full-blown business crisis.
If your business relies on any specialised software – print management, booking systems, point-of-sale, remote access tools – it’s worth having a conversation with whoever manages your IT about how quickly security updates get applied, and whether those systems really need to be accessible from the public internet at all. Those two questions alone would have protected every one of the 440+ organisations caught out in this particular attack.
If you’re not sure whether your business is exposed to this kind of risk, Maximum IT Solutions offers a free security assessment for businesses across Gippsland and regional Victoria. We’ll review your current setup and flag anything that needs urgent attention — no obligation.
(+61) 0412 440 804
