According to CoinMeta, the AI botnet group made extensive use of 440 instances of PaperCut in 48 countries, ignoring the exclusion lists set by their operators. This PaperCut NG / MF exploitation campaign affected 11 organizations within 26 seconds. Once the full operation was launched, a high school in the United States transitioned from initial access to complete domain administrator control within 7 minutes. The operational timeline of this campaign was documented by Greynoise in their report "Botnet Out of Control," which was first disclosed on September 9, 2026, with detailed data updated on September 28. The campaign targeted PaperCut NG / MF, which is a print management software that typically operates with system-level permissions on Windows and is often integrated with activity directory environments.