{
 "type": "bundle",
 "id": "bundle--854fa119-6606-4259-a23b-6d4eecb3c548",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Russian-speaking actor uses hundreds of AI agents to exploit PaperCut across 48 countries",
   "description": "Blackpoint Cyber and GreyNoise Intelligence reported a Russian-speaking actor operating from 45.142.193[.]132 who used hundreds of AI agents powered by OpenAI Codex and DeepSeek models to exploit PaperCut CVE-2026-81578 and CVE-2026-82078. Vulnerability research began on 31 August 2026 and remote code execution against the first victim was achieved in under four hours, with 11 organisations compromised within 26 seconds of campaign launch and one high school taken from initial access to domain admin in seven minutes. In total 440+ PaperCut MF/NG instances across 395 organisations in 48 countries were compromised, with education targets in Australia, the US, UK, France, Spain, Canada, Belgium, Portugal, Germany and Switzerland. Post-exploitation tooling included Mimikatz, SharpHound, Certipy, Rubeus and Impacket; domain administrator was obtained at 12 organisations.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/russian-speaking-actor-uses-hundreds-of-ai-agents-to-exploit-papercut-across-48-countries/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-31",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Education",
    "Government",
    "Professional Services"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Australia",
   "country": "AU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6c899edb-5dd1-57ff-8c6f-a43cede344b0",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e91bd8e7-8960-5be2-9b2f-c4c765833a5d",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United Kingdom",
   "country": "GB"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8b495a5b-8600-5b3a-95b0-888dc02210c8",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--f9d2ee61-54dd-59f4-bd2d-fbac39debc46",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "France",
   "country": "FR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--08b210a2-2294-5716-9964-7bae63b44f38",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--f9d2ee61-54dd-59f4-bd2d-fbac39debc46",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--562bb4c5-4ed9-580f-b37e-c9ae676755f0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Spain",
   "country": "ES"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--b9797bf5-7ce0-51b3-84c6-5a99c433cc27",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--562bb4c5-4ed9-580f-b37e-c9ae676755f0",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--7f77e251-85bd-53e4-bc72-1edcb2d04d5d",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Canada",
   "country": "CA"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--f253adaa-4dbc-5476-8cfd-5622ac6d9a2a",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--7f77e251-85bd-53e4-bc72-1edcb2d04d5d",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--f8de1409-c8bc-547e-863c-07817401d9a2",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Belgium",
   "country": "BE"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--67b1d27a-748d-56d6-a1fa-4d0634924114",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--f8de1409-c8bc-547e-863c-07817401d9a2",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--dd1bec90-2604-53f0-953a-bab543805077",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Portugal",
   "country": "PT"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--4c3eefe1-da2d-56c5-8e34-790324e9bbc5",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--dd1bec90-2604-53f0-953a-bab543805077",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Germany",
   "country": "DE"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8b803bdb-0ca1-5685-be70-4eacad913cac",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--aa8b441f-2a10-5e00-b00e-56ba6bfa70f6",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Switzerland",
   "country": "CH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--b9b6c5c4-944f-5c7b-a4ce-071374ff250a",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--aa8b441f-2a10-5e00-b00e-56ba6bfa70f6",
   "description": "country named in the coverage"
  }
 ]
}